Overview

overview

10

Static

static

audiodg.exe

windows7-x64

10

audiodg.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    audiodg.exe

  • Size

    807KB

  • Sample

    230110-jq4nhafd24

  • MD5

    93a0c7df80d71587e83013e78ff90885

  • SHA1

    6007777abc335dbc37c1fdb45d59480ee6d006e2

  • SHA256

    6b6405b7d1f150e3883916aa3f64125fd499b3a4d579480992d9b3fe4398acf9

  • SHA512

    cfad006ee3890907deaa0aea77b949116e826f87f11b00ab56109c365d628b5e782009abd8887f1973f90247a1853ef0ec29199f0a71de2bc56a0b3b3cbec158

  • SSDEEP

    24576:d0Gs5nyyxDqEZV/NWC91FS/gg4iPULgh/Wgfz:d0Gs5nyCDqEZVr18/gg4ixh/Wgf

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/gk1/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      audiodg.exe

    • Size

      807KB

    • MD5

      93a0c7df80d71587e83013e78ff90885

    • SHA1

      6007777abc335dbc37c1fdb45d59480ee6d006e2

    • SHA256

      6b6405b7d1f150e3883916aa3f64125fd499b3a4d579480992d9b3fe4398acf9

    • SHA512

      cfad006ee3890907deaa0aea77b949116e826f87f11b00ab56109c365d628b5e782009abd8887f1973f90247a1853ef0ec29199f0a71de2bc56a0b3b3cbec158

    • SSDEEP

      24576:d0Gs5nyyxDqEZV/NWC91FS/gg4iPULgh/Wgfz:d0Gs5nyCDqEZVr18/gg4ixh/Wgf

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks