General
-
Target
572-68-0x0000000000400000-0x0000000000615000-memory.dmp
-
Size
2.1MB
-
MD5
161ccfd6b1aaf96c5bdac708b1b3c9cd
-
SHA1
c6e1c0e4b063d865d4d1dfba4903570c5f2377b4
-
SHA256
9687f70fa1a4b73e9839f07aaa61b1bd5be2ade1a05d930be665226c849f0b70
-
SHA512
32a0e7498dcc8dc008032ebf6a4cbe9c8fdf85fd9203f354eb1de74aa6dce0f2e1bb0d65947657ffe5c192490ec1ebdf2010fb7b00eec70bbaf14318304b21cc
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqhIzmd:nSHIG6mQwGmfOQd8YhY0/EMUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://171.22.30.164/chang3/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
572-68-0x0000000000400000-0x0000000000615000-memory.dmp
Headers
Sections