General
-
Target
1744-54-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
ca4f42f7a4e0d2eacae3bae7c4533276
-
SHA1
50cfb264c35ee3724c54dcc0e825011e8c0b8240
-
SHA256
e31be25408dd4c49152d0a051cee534b0fd18eaa7fb8fceb9b7aaf19eee48bf0
-
SHA512
4d45c4e4bf438420b1c94dac642ea14eeb35d307f0e84dc3ba5f0b93f3231a1d8f545de6da2dbdc6986d714060cdf36bfb5da9749abd1330467c198d6f734b20
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://abjkad.com/zoro/zoro3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1744-54-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections