General
-
Target
1768-69-0x0000000000400000-0x0000000001462000-memory.dmp
-
Size
16.4MB
-
MD5
a90ed00faac0fdc6da84f82900c251db
-
SHA1
d93a73ca4ee0f862137a078b674311420a8e95bf
-
SHA256
6d42ba537d302b39698e9926df487ae8a0149a6bc1edf45a59d049ef24c8f516
-
SHA512
de00cbfe9820589efdf2c0681dd543eb86893d6674b4607e17b0a0a3a4ac9286ffa7013c915ecb973ba0d158063b63d67e64c235ebaeb45b144bde92002a0dbf
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EquCIzmd:nSHIG6mQwGmfOQd8YhY0/EGUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://194.180.48.58/web/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1768-69-0x0000000000400000-0x0000000001462000-memory.dmp
Headers
Sections