General
-
Target
2840-16-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
1ab5c81f3c5616273115a85680dc1601
-
SHA1
441c8ca2854b71a55c4109a458e8397b96eb6701
-
SHA256
96554c2259c8ee634d2e660504daa94cc40e2e27540c722ec6dbee27918a9c2d
-
SHA512
b23a919e05788c736c993d2d4ece77c9ea53877e9902035775a50ee5148e2837219aeea5f10a1815d20efa28c67239922ea90cb964668407a33c8e9e299fc071
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://216.128.145.196/~wellseconds/?p=007634106655
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2840-16-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections