General
-
Target
2976-78-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
e19a92e076ef86ed1088ada1b5f3d2e6
-
SHA1
e015e2c9c567a4c21a6d76ce737098b5328597f3
-
SHA256
7a41b79dda6ee261f27d5db16ca963b3bd3b22ce0b6d48e41f53a7b9795342a7
-
SHA512
e72c9ee94d87f0b55e324fb44bd7193374d8220d12aeee54c421449207cad1cd25b23e0148df54b6e508ce0a3130fdf9ca992d2f56a856a823058cb407b39231
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/Eq2Izmd:nSHIG6mQwGmfOQd8YhY0/EzUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://171.22.30.147/mous/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2976-78-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections