General
-
Target
3792-1089-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
2fa88e1cf628e70be436d155ed57ab93
-
SHA1
21d792b656b43d3e8b80c159a6c891e24edbe799
-
SHA256
0bad3280178a142840e1a892a8eb947556e6b0d170464025cd1e92768b644cab
-
SHA512
b2b7ba229d67b26c445e5116824b38957230ace6eb98342f1d7778b53c5e30d80231d2704b1a216bbececb880f60bb8d4ce50ae9d48d94390535f1454beba2e8
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqNIzmd:nSHIG6mQwGmfOQd8YhY0/EkUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://2.59.254.19/noko/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
3792-1089-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections