General
-
Target
584-66-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
785e092601a6ba9238c23346dd61be23
-
SHA1
0fb4e761215a82e4ef9be8752f09397d26b75898
-
SHA256
04b6745894abdde4f65385afdee06cc96fa1fd0ac867d1a35ca61ec23dfed10d
-
SHA512
1e17d52c1bd23bb73e47687a3539b65dd625d09689cee077cb0e66b0bd5ba37f181e78ab696ed9589652c5c150d5a16255ac2308d72e6c5f74c96219d71a55ad
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://138.68.56.139/?p=229442047
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
584-66-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections