Extracted

• • Target

    9df0c87c60e94ac71d89e385748dd343_JaffaCakes118

  • Size

    331KB

  • MD5

    9df0c87c60e94ac71d89e385748dd343

  • SHA1

    85d9f103e38cb8499ed8b41cb1afe59a827c2660

  • SHA256

    7e676ed9d711f1dba87da17ec5cb269d69ed2401c5ecc48162a064ccfaf1da72

  • SHA512

    4e30dc38ccb30235a97ff0eec767793420063cc77cfa4ffb04b2bd3b93b784df045b9e95c6ef5627f20d4979160fa4ecf4267746ec2e9c9a4c2100b7f7766fb3

  • SSDEEP

    6144:3AttGYdzI57asxU/IdrijBerlCOv8XmTjkLm8nfsxF7wjimZ:QbjI59VMA82vkLnfOOim

  Score

  10^/10

  lokibotagilenetcollectionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2