General
-
Target
1052-1224-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
78c135ffca0af65a5bf993ed5eeec609
-
SHA1
0fe0c8ec333e3911a7440a205520a95719adf7c7
-
SHA256
3e0a1e8e94f2042d6fae4bfc2752d7002a1ff8c809385f75ab1aa1eafd376004
-
SHA512
cd1f8868da3c9cff1f397eb7fc4b9010c36db353eedb14f983d3eb4269337cfc1b2659fef25749c88603fdda17b1fe5a1409b523ad33684126ba48dc8004a670
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqoIzmd:nSHIG6mQwGmfOQd8YhY0/ExUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://194.55.224.10/collins/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1052-1224-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections