General
-
Target
1740-1223-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
d059a00036032452bc6b803ec78d850f
-
SHA1
19970a7e5bb4e984c3bbf9b4e980d6ff7ed7bdd4
-
SHA256
bd83ca9665fab01b48ae7f7c8adfb63aaa0ae56f1dd28f3de9e5216bd28236b4
-
SHA512
85ef241adfb41aeb58ccd1ffbc1ba97c23119686665cd78770cd7ad3cbbdc3c50858d6300a0e338b9202e3e71a812cb2e246d15ce3fc51e846e677888c5f6cef
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqRIzmd:nSHIG6mQwGmfOQd8YhY0/EwUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://194.55.224.10/collins/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1740-1223-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections