Overview

overview

10

Static

static

3

INQUIRY_00...23.exe

windows7-x64

10

INQUIRY_00...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INQUIRY_009270_9092023(1).rar

  • Size

    487KB

  • Sample

    231011-lg5wbadg9v

  • MD5

    672b7f2610c58d55e7c24f17e5ec510b

  • SHA1

    9b31c6ced3f816f1b9704dad4d443891598489f3

  • SHA256

    964905ccc546aee4064e5c384c1396b39166c351bfe1ccaf132520d5408212f6

  • SHA512

    f4f003aef088618c45a9ddb84ee1b6d659b6b4a2d1544651cfce69e03544ce3a2cefb85e36cd1c96a344700d82a0632ffd9923ecbc3ec91334eb6e9ad39dd666

  • SSDEEP

    12288:U8UqkKNJp6IqcDJCvSo+s/nAex/3Ih1BiwFRL9OE6zWUg4x:fUqzzOcdmSG/AeB4XQwFRL9OBZzx

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://evil2.simcoes.top/_errorpages/evil2/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      INQUIRY_009270_9092023.exe

    • Size

      538KB

    • MD5

      0526e3d5bf402ab88642a83f1c0133c7

    • SHA1

      c96e45e087ff73f6aea906be31660171dc1385b7

    • SHA256

      7ab4ea672597b7752cb47b6d80602ae0a76e78de78336d147c92b2669111bf75

    • SHA512

      fd8b5f27332813e07d20bc829fcbde1956d26bf82d7d998084a0c52f214adda75909a34e3ba0e1080ea4e57425688ed2d2ac9978d3d5aeb64b6c87f6e15a0d1e

    • SSDEEP

      12288:u2iN4yiRJU/WcchfHapg/FQUm4HLW4CbkmCvOsth/:u19Fe5dHkGzzHNmC3

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks