General
-
Target
1704310x00000000004000000x00000000004A2000memory_JC.dmp
-
Size
648KB
-
MD5
cf858902a417711539d40e1c6f7ae3e3
-
SHA1
d9dba0d806d337aa39600f949dbd89d81670267c
-
SHA256
ea9c78605de3946d3a20b79b73d4199b42d642d8e8c5e3fa7521afa2e8b4a679
-
SHA512
3cf03f660876d980436c3dfc561345ab9aa6937d8af013093e02f9df6e440a1c21e7a201b95d0ff9dcb6c38842ea99a33a2bc83091546ceb0f477c85065a749a
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://backupleads24.sytes.net/jzdgfsh/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1704310x00000000004000000x00000000004A2000memory_JC.dmp
Headers
Sections