General
-
Target
d5032a79b95be7ad05d38d1ae3c7f26f
-
Size
538KB
-
Sample
240319-c755bsfd49
-
MD5
d5032a79b95be7ad05d38d1ae3c7f26f
-
SHA1
430594789e765a2e5a956d056a9868696160060c
-
SHA256
5da233d0af3767b7b5434003a6d6289750d09cfc8b984e2769f7643b7bba9e84
-
SHA512
1b37fae06360b707c958cf912ae0e7f6fbfccaf5943a58b4e7080fe04aa770c445a78ed3aabfe0407fd13faa6503bf8af4d1cb3906e0295dc5df1d68357f1b29
-
SSDEEP
12288:cNScfPpLsclvAUeG++/oZCJQxpjuikWFbatgJMnNiqRxA:cM+pL3lYp+Q9xpjuikW0jnQUxA
Static task
static1
Behavioral task
behavioral1
Sample
ENQUIRIES.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ENQUIRIES.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
lokibot
https://www.rnofinancial.com.au/wp02/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
ENQUIRIES.exe
-
Size
753KB
-
MD5
50c7ebc89793bd7c8ba93468efec11dc
-
SHA1
803ac40bd7cc00447efc9dbf81012fe43d67c593
-
SHA256
1d6fd54291eed895054d2c88063cadac20c03b9a806b6eaec65d8a5e20af560e
-
SHA512
a44e9d91ca66849989bd9f367de6a9ec55cfd3f6e31a9288f133075477edab0348a4b2080becbd40cd2fe4c794c9ed1c49f696be79b44216dc2725adfc9aacc7
-
SSDEEP
12288:shVsgnLAc4C+E/cZOJyx1jiiyWFbMx6JcnNCqtxY:shVpnM/E0dx1jiiyW6Xn8OxY
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-