General
-
Target
1220-74-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
2d293c8ad472df5b8ae4d4c8f07b636b
-
SHA1
f6b4ad80e63228bd1697353f476053f33b38ce62
-
SHA256
4adfebb78cc76353d9ae20e4e79dcbb9b8f0e5662d1d4285be49e34f04277a4b
-
SHA512
4ec2e5d601a76095ee1366b50c18a2b34b4101ae01f240853a516481c96a86cbd3a6ed1b1c09b20baa02eacfcd1f4068904037151cf17ee704c811b3f1208a4d
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://216.128.145.196/~wellseconds/?p=5809290034477
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1220-74-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections