General
-
Target
692-67-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
d30573c3446b287c812d2cac43a49db9
-
SHA1
3e04c07102ff9a8a29c32a2a9e324a14eb958d65
-
SHA256
62091fa0f1e0da75be3b119d24c30f2165be64de46ba67c7d7dfeab8b4eea904
-
SHA512
36bd1bf38df81c6845712d493ecb46c6d27a88b0b72acfff6c4899ceb6d90756439fd8c924da1f500ba77bf91a7c83a032d1b82de8fafaf615945964de837119
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://185.246.220.60/sirR/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
692-67-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections