General
-
Target
4340-1223-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
c91d14def9b1b1d628db2cf7daa7464f
-
SHA1
71da965f9b7c8d51ebd442a80cd686cf81573d93
-
SHA256
67327a83d176385e0431dc9a822bfcab0646c173be68b55177a19cd6d3a27e0f
-
SHA512
443d10b60b1fa131e9492566e8b29c1045ac03523b46b1a855a2a2ff0edab9d0021df261543d37fda691759510d85389cf99b34aff513105aae4cb7b0db3c4ef
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EquIzmd:nSHIG6mQwGmfOQd8YhY0/EvUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://194.55.224.11/mathew/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
4340-1223-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections