Extracted

• • Target
    INQUIRY 200609-07_06_2020.exe
  • Size 293KB
  • SHA256 c9365a9c17d0b389e953ec604f7a12efb4555f35fe74d8ff99d181e252894a63
  • MD5 1ed0376892edb0aca1e2b1c07ebb7830
  • SHA1 79c5bea6346caafff580f21e0db8d14e288a4fc2
  • SHA512 390cdc119fc0d58448a4a4e78f29cc13c35b772a0e0b72b67d62e9f6ede627f3aa2c6919c19f53da4834e2c2c3876a2b97f026536f9d668168a58f7cd4722852
  • SSDEEP 6144:HPCganNbIJ9Zw715R0W25/WQsF+CnfZMhLu8lF90AaamNAsu70unL9XTbnyokkuV:dan52YrR0W21Wd+CfeMAnwNkXnyoNuum
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2
• • Target
    $APPDATA/simpleLogin/ear/AvVsPkDH.dll
  • Size 26KB
  • SHA256 28b451525a9122e07d3925643c432fb5b6625919d2ce172a65f79eae64c3aa9f
  • MD5 dcb503b44bfe005df85e08a645e7c1e3
  • SHA1 30e1cf630147d901c792049b1902885b4ffe0af8
  • SHA512 9bba86c81d55e6bf200a73c1233d806b57f6049aa30d17d5ad0cf6ce32a6e28581148b61c6f6f88c212346fa2d6cbcacabfd88e724ff6ceb40637f719f2e6c5e
  • SSDEEP 384:UCjkl0Ke5XN3XEUwBxGTKyP5IULV7pTuWECTE9W8S9UkOWKrhmdTXcpddWBK2yW4:UCjGe5dE2KkrxVTPTeFS9UkOWqmdTp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    $APPDATA/simpleLogin/ear/jbimpui.dll
  • Size 12KB
  • SHA256 a8a39f536e1322929195fa6fd8f6f3fa1225898cb11165479acaeae4349ada62
  • MD5 e3506368b06754e2cc27e29a1f2d3f8c
  • SHA1 207d3945c93b499e7e5c28d406a9aa5465880da4
  • SHA512 8c437e63b81826e673e30f44f0b23f6fa79b5dd1622dbc08d134c472fe821eecc07a48f1e944cd8f8b18cd2135e7379b9c1962d853b2374c4f77dadaf017a829
  • SSDEEP 96:1REWQ8NNbW/AGcydg0IDg6beRJhexnDDQJ00B84iJT7JbzBkAIeVAWDBfkKhY76q:wWbNNbW/KlIlUkZ6wIUW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    $APPDATA/simpleLogin/ear/resToResX.exe
  • Size 38KB
  • SHA256 3a530aacf477d005147c3b3a782b96a7c9a8a17a0a3e163be255ca8a133ea430
  • MD5 8952521941dbe005a4ac2fe8a88aba2c
  • SHA1 b5114de8c2e78d72ec8ddb6ab7bcb02b1bb5291f
  • SHA512 a79f7bd27370578be53e1ff46dbe52fc95c153c7213ad9ca5d2206c3d6e8ad315bb98058ad8d806aa33affc1c22c9784ba73b2e7da20b36dd77421f85a90d0ba
  • SSDEEP 384:J1rc09Z2gN3uUXCKDWK93bZ3Jd0Oi9jqUOJesaxdu/+lW8wWhLCcMe/oTC4:H12jUXCH4rSqFCbU+17L3d/o+4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8
• • Target
    $APPDATA/speakers/manifest/74.opends60.dll
  • Size 47B
  • SHA256 d2b3069fb7c0fdfae1f1ac228c38be695f6b3155d00ae20c30acdddc39c31ace
  • MD5 4984eb04c8300f18b3cc077c0b589c9c
  • SHA1 b23c5002ea5d690740f3bd6df8a799dca6a2ca1f
  • SHA512 400c423f22a378589f4cc227a030626f408ad24d40ae524eaf3bb4119a427ce968f112100e6c1d7b807f1ac7db67fb6a1325d899c75889b2b80f7073da999324
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral10behavioral9
• • Target
    $APPDATA/speakers/manifest/edbgcl.dll
  • Size 28KB
  • SHA256 a071c2d03d3f9fc282c49e98758e012b9f8c0675b00b7d3589e4f20a98e2a950
  • MD5 82645c2a2cb19c465c1d57e561d022b8
  • SHA1 ce21a234c6821b0aea12cf3b5cb1b3fcdc5b8ec7
  • SHA512 204f7c543eb2b8b6a983d39a07722f4fbbc7f60af082ce0c6a90f31c44b920115b1534bcdf3b14e3216af0894ec4ad974f24874a1f28716a98b0443064fa4d1a
  • SSDEEP 768:otC6PwhUl8ADS6lTCo1kjWUnFXz8h1rV:otCOXl8Ihu8kjW6K1rV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral11behavioral12
• • Target
    $PLUGINSDIR/advsplash.dll
  • Size 5KB
  • SHA256 b1ef42f722254532953051d08e6763fd1d9087441b2c58c268ffc71a37bbfcdd
  • MD5 3536302baf9f0a47cd5f9c0a5caf5bdd
  • SHA1 d6f2a6267724a122a10fc41c12cef2f69a3c1987
  • SHA512 8d5ce29225ced31c7352f280ca7667703ce3337ba10a73a8fe398bcd43ab742fbd78123a5665babddb2a43cc564262c9e64de8c86cd46900e6c7bc9194f68ef0
  • SSDEEP 96:HqNXqwK188CgAtXvZBkjDf0yf9ysrtWpThwol:HAqrg1XvZB6kYtWpt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral13behavioral14
• • Target
    $TEMP/Barracoon.dll
  • Size 16KB
  • SHA256 5a3c55f4e99aed79b58cfc985661f0d055b3ddb759c96757724407d7435278b4
  • MD5 78b9abbf79ea11a22c73107e63924bf7
  • SHA1 022e05bc47a33b20eeaf541d72b915187cc0702c
  • SHA512 aec84bbb46e93d149e955a7753bd9b138f1aa93e347f04ef6ec7bb78b999446265ec20fe555b0d1d16c959551019eea7b69b6dc75c2060605115327210a6b879
  • SSDEEP 192:WyqDoJe27ORNBXzXwTR1muELYWgHASgHASgHArHxvkZVk8e3zQeJuS2OkAda3nau:WvoJe2KRHXDgmueYUoorHxwVPeW6V+O
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral15behavioral16
• • Target
    $TEMP/alumni_reunions/calendars/retail/52.opends60.dll
  • Size 48B
  • SHA256 8935bcf2c389ffdfa7bd3eccc2af92dd8092f11f8845d95f16e61f7393edf86b
  • MD5 2c113f0eada02c58621b12aa16cf85c9
  • SHA1 a7a8b1b971c2765befdb16ee2b6043dd2dc155db
  • SHA512 696b7699f1e57538549f9715be516ee101642c2d109d87cc0033f174c2151a1b4fafb00d881650f4e8947ce09565f6431092f67464812cbee43a18cf5a893285
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral17behavioral18
• • Target
    $TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe
  • Size 36KB
  • SHA256 46b1a81f5ebb43404ac7229d14593d5f47930c8fc3fb5279ac5402507f7ea7b3
  • MD5 6ad1c32675ecd48f15535e4a0e474e28
  • SHA1 2d9b200ea1d9fb6442f21bb5441072bd4b9d1968
  • SHA512 8a425760aa2e7bbe286b2322d2413eaee42d7e386448050c46f61c461481407800ed2b5bd19beee77dd74fcb30e496d36c303d0845e1ee138babf6f483da1659
  • SSDEEP 384:EW2BCQspyJi6d0XsNGIEP/06V78FIISqa4ld2Cxs+NHsRo8CWewMW:fBqJbS8N7IIlaAs+NHsKe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral19behavioral20
• • Target
    $TEMP/alumni_reunions/calendars/retail/VsLogP.dll
  • Size 6KB
  • SHA256 0e269d428ecc49125bd2ff997a659c47d6b8124d38e1d9102d08e98f64055e85
  • MD5 42741f3de52a793918627eacbf6a45ca
  • SHA1 31310a08b370b8e56445791d93b6bf87464e808d
  • SHA512 0143fab89d72cf3acea003ac418702dcc8ef3d9788396b7c6d797854904f21b1b024f5d9304346c9e8a1ae23fad25f69b3e01570984f50fdedc47967618c5c2a
  • SSDEEP 96:UteThBZRibjkt3sb8z6AC+AqAEWrZAdxWPV0:UteTXZRjt3sQzBAq5Wr+dxWN0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral21behavioral22
• • Target
    $TEMP/alumni_reunions/calendars/retail/almap.dll
  • Size 16KB
  • SHA256 154c99a265cff2e12f151d77d561f5a80b11c8227dcfc61cad0fbf1fb66d35b5
  • MD5 595f376cfd0583882f67f3bf16d88760
  • SHA1 699784474329d2f548a869fdd6211ffc5b7316cc
  • SHA512 fc0eaade59dbf155cb96a1750e849a78a2b59e74045ba729216835788f1de3b1690c467fe871fc5eda6ca59007dbec3ea43e8dd987786a4a355dd88a6aeb3ffb
  • SSDEEP 384:8qUuKJpjw9YxO9FJUuDq9j8tCqYqOO//ur/J5J+Of4o3VghRGA:8qUuKJpjwWO9FJUuDqigqYqOO//ur/JU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral23behavioral24
• • Target
    $TEMP/map/clickheat/documents/74.opends60.dll
  • Size 47B
  • SHA256 d2b3069fb7c0fdfae1f1ac228c38be695f6b3155d00ae20c30acdddc39c31ace
  • MD5 4984eb04c8300f18b3cc077c0b589c9c
  • SHA1 b23c5002ea5d690740f3bd6df8a799dca6a2ca1f
  • SHA512 400c423f22a378589f4cc227a030626f408ad24d40ae524eaf3bb4119a427ce968f112100e6c1d7b807f1ac7db67fb6a1325d899c75889b2b80f7073da999324
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral25behavioral26
• • Target
    $TEMP/map/clickheat/documents/msisip.dll
  • Size 15KB
  • SHA256 cacbc2940693d704d489f90015d24a01ec509b426bd96febc1852131a53977b8
  • MD5 da23a12845607133acf1db3502d4e575
  • SHA1 3808f3a44ffb3b2bdb7a5e57c650b0a96cd52b5f
  • SHA512 8b0d6a3598d4bb6b4dd061d6ad1c56c1dc8fcad5047e5c484c9b85a9698e52029cd0d873dbe8c74bcb53e6d61750fbb616f1c9e6f8ecebb82367d9e73a14ba1b
  • SSDEEP 192:tF8MmFDXLSPZdLzAfbkKIcY7HvqAdsiLuvRzJhaSjocS0xY0Yrk26Ab8WQn:tqvFDXmPZN+/IcY7HyniCRa4IIYvGWQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  discovery

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  behavioral27behavioral28
• • Target
    $TEMP/referral/msvcrt80.dll
  • Size 38KB
  • SHA256 19f4c2ffc874646f4f290a4255cba805e597d4569684d0537591588fea2f1962
  • MD5 cdce62bd68cfd6b3bee664e32453708a
  • SHA1 0315c77484f4f28c8e17c05ee20695dcd6001ce2
  • SHA512 0e7aaa37a89f6bbe857112e749860e604573ec6473ae4b6232781b7580659376b22c40395ff302049f4764f85ed2dfc88a5268b5896288da4f3e9b53a17a00dc
  • SSDEEP 768:Jq8q7Y4Y4Y4d+pfeC5Z8U1l0TOu6OXQ+c+jiut+vSL3uBsP:Jq9dqfZ5Z8U10cA5QaGsP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral29behavioral30