General
-
Target
4664-1090-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
f049de6bcfe2edccbbc4a50a1b38c595
-
SHA1
e3c2b56ad373a0ca38111ab9163e014eae8eff55
-
SHA256
dab84dca412628a004d879168daed62d1fc8534cfffb30b52291876ae5f0d285
-
SHA512
dbf705e5315ad6360512971ce34b984ddc6a4c79c9259b2276abaeed55a55754589a0505a98f11c6b6e98f9183477379d0b873458906c91e4aca2efbc0f79cd1
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqTIzmd:nSHIG6mQwGmfOQd8YhY0/EiUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://194.55.224.11/mathew/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
4664-1090-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections