General
-
Target
2988-69-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
d50101740ad56a70b9ed1ea854286b6a
-
SHA1
85ca268be7a9c05275e39c8b40e2d76463060e32
-
SHA256
0cc4f4339ec3b88363f83a2f752dcf3c1035c9071d6a6fe741d3edb76e7b082e
-
SHA512
de277e002bb9965c55dba50dd91110993ab5e5b7954a9bf7ca75bdd6270634e97a1e0ed3fb3cf37c27e572ebf23bf7dcd3c4bde30018aad2a5f561591ea1b22b
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://173.208.204.37/k.php/8F1Wz9GpS2l8W
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2988-69-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections