General
-
Target
2868-66-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
b2f6c00297d58a4f183217950496b194
-
SHA1
e7e315f5e752ca2f9bbdc40095a1b7759cbc5c81
-
SHA256
d9e73e6beae6785ddb716a3ec6d71b2bb2d60046f939495970a987ba9712a0bf
-
SHA512
9f02a0806f28cf2086e0600f9fa94cdce5b7bbc838565e109b5bfdba54c6b73e7f40cdbeb1c3c30ad3a7b81f38db133a1da427cc596a01c7efba36ee245a18d1
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://138.68.56.139/?p=8184221136284
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2868-66-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections