General

  • Target

    484-39-0x0000000000400000-0x00000000004A2000-memory.dmp

  • Size

    648KB

  • MD5

    f0857f9736a0a180dfa8e256d14d0ff0

  • SHA1

    a6782f9045295fc34298db75e72bacf57a9e3abf

  • SHA256

    a9db3eebc28c18208bee5bb9f94d2aeaca02a895754c1b2802e6dfa3db298e1a

  • SHA512

    5eb9a688b72edead9fcf6541c75a28b871a202cae12829a51911ca1945a3f28609f0117ab7d414efacebbf6ac2ae903046be701a84061ba938c660bd0567aa7f

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

Score
10/10

Malware Config

Extracted

Family

lokibot

C2

http://kelly.chinacarbonfiber.buzz/_errorpages/kelly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 484-39-0x0000000000400000-0x00000000004A2000-memory.dmp
    .exe windows x86


    Headers

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.