Extracted

• • Target

    5f545c90db6c79137122b56710c19af3_JaffaCakes118

  • Size

    441KB

  • MD5

    5f545c90db6c79137122b56710c19af3

  • SHA1

    02452cbcd6cf270a8ff68c025904ee3880119521

  • SHA256

    09c86bd377480a59206a7680e42afae83ef20138b1481981a872d309f6094e5d

  • SHA512

    f3a38db33d35f04998a5f77a1a15266f7406fdc732a2f79429288a0e65a1632d4e644b1035b0e56c4688599d3f4b99414b0c99876b7931e8fe6e89418212a142

  • SSDEEP

    12288:mS2a83T3IKwfUu2iKepRhJKQPV3n3TcWI:mVd3TYr6IpRbKa3njcW

  Score

  10^/10

  lokibotagilenetcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2