General
-
Target
3164-1092-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
599dc2e45bd4af8408df69cd5b81e879
-
SHA1
5ae815a2007848086c6badda8da17fea0ea3ca52
-
SHA256
dee92a145b8cac3d3765b6fe639b539204c4e3f65ed7ec2c498d9229cfcdc8b9
-
SHA512
bd403b0e0414697ced394e2a88ad5f84643c5b687663e61884dfecec4bfb58ab66c6cee66f2f8f284be4676c0c6ea61b614227e0a7a400aded27ae645cbff346
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqIIzmd:nSHIG6mQwGmfOQd8YhY0/E9UG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://194.55.224.10/collins/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
3164-1092-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections