General
-
Target
3176-1223-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
5a1397da35e0f38932648e8fc276f360
-
SHA1
988ae0ddc07c6aa77340127079863491ce4bba33
-
SHA256
ad61eaa0c9dcf51da33b1d1b7ea96972118aa50392110eb445a2ad56ff7fac14
-
SHA512
b0ed7c59215be68e4456f4591403c90abcf3e53c57fcce80e5017f14b4aa8c64df43091f8c055e1b071eddb6461528986034bbf08b7240c7663ca4ee9e5c64b6
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqxIzmd:nSHIG6mQwGmfOQd8YhY0/EYUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://79.110.48.215/thirdugo/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
3176-1223-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections