General

  • Target

    1744-54-0x0000000000400000-0x00000000004A2000-memory.dmp

  • Size

    648KB

  • MD5

    ca4f42f7a4e0d2eacae3bae7c4533276

  • SHA1

    50cfb264c35ee3724c54dcc0e825011e8c0b8240

  • SHA256

    e31be25408dd4c49152d0a051cee534b0fd18eaa7fb8fceb9b7aaf19eee48bf0

  • SHA512

    4d45c4e4bf438420b1c94dac642ea14eeb35d307f0e84dc3ba5f0b93f3231a1d8f545de6da2dbdc6986d714060cdf36bfb5da9749abd1330467c198d6f734b20

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

Score
10/10

Malware Config

Extracted

Family

lokibot

C2

http://abjkad.com/zoro/zoro3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1744-54-0x0000000000400000-0x00000000004A2000-memory.dmp
    .exe windows x86


    Headers

    Sections