Extracted

• • Target

    02_2019_Order_Package_20180329_06575998876_2019_signed.exe

  • Size

    947KB

  • MD5

    a0618e93947b2aeb2275200f18b4ae6b

  • SHA1

    d3f3b4741a04877a06c9307cf7d0e0daa9d48e36

  • SHA256

    7737901daf766eed03fa7a2bd4317a71760bd680fdadd4a827431774d984757a

  • SHA512

    33c5c6b4d555e87775b6680dd5dd25f009f94b0fd05876dc63344e5ee0d52d2df940923db819ff31437bb4132f94a73c70390596b63d643bb7d58b73dd80c09d

  • SSDEEP

    12288:+JsocMd7RpR66ri/hp4vKNZUuOKE0Cgoe4fLYwLcfCLFSLfmez:+m3w7Rb66+/YhM8fecYKcqZSH

  Score

  10^/10

  agilenetlokibotcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2