General
-
Target
1404-85-0x0000000000400000-0x0000000000615000-memory.dmp
-
Size
2.1MB
-
MD5
133fd9617fe046ebcb866322578f6f87
-
SHA1
e39036a06c76185d0d7ac0d350f2288f82a85493
-
SHA256
30bec55be86d155b5b28a3f5807498f1fda2b0c0791c2977d7585d3b3001a860
-
SHA512
754846593e47cf6007201b56f0e5e3845feb5f95dc4b0cf9aa865cc09e5526d91356352855967eef3eb71484e01ccacc1aaeadf4ad7c92a26f053744d065af97
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqdIzmd:nSHIG6mQwGmfOQd8YhY0/EwUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://171.22.30.164/chang3/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1404-85-0x0000000000400000-0x0000000000615000-memory.dmp
Headers
Sections