General

  • Target

    3064-68-0x0000000000400000-0x00000000004A2000-memory.dmp

  • Size

    648KB

  • MD5

    640d57537d70d559d1888a5e669f981a

  • SHA1

    dd391729c5bc43854a19c0bd4c96283e05f03050

  • SHA256

    333ed63c73cf898c9810d8b3de4f8c7edf6748b911e43686037b1a557d963ace

  • SHA512

    a0cf282f65a47704c893a163a7e5003e6e3a358a61948d6a76f1b15eb40b1f92f9d138c299d2a11e4b9ca941dc4f11edef90066590c60295374791f58c366316

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqLIzmd:nSHIG6mQwGmfOQd8YhY0/E2UG

Score
10/10

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/fresh/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3064-68-0x0000000000400000-0x00000000004A2000-memory.dmp
    .exe windows x86


    Headers

    Sections