General
-
Target
1460-1091-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
f53cd967f5b3565c260e44e63bde2037
-
SHA1
c3b3d00ed0f91cc22dc718eb52e9045c5a79eb5f
-
SHA256
72233dfce2c9e805cec60e4de25d7d77da98ab5c208f7ca9fd908228628df072
-
SHA512
7bf34259aa136e6ed8e4433f3276f284456c980917d6811761481f685e9402b607b369056a72bd6053bddaa0066d6972ef3c3e772f83a731f9ab2f162075d362
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqXIzmd:nSHIG6mQwGmfOQd8YhY0/ESUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://163.123.143.204/_errorpages/mathew/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1460-1091-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections