General
-
Target
2532-24-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
70094e40e4aaf2512459448f7de158e7
-
SHA1
3cf4e6d9f257ce9090aa49374bcf592cbdfec726
-
SHA256
e27de488159fe5b57c69f3a44f858b5c789c775afa352ec91e135f84aaae9c81
-
SHA512
9cd8cb97180202efc6f791d9bd04520f543b133333f76a8146346dfc8647c151efa0e09c93c23ad257e430d141cbd842eb08b930a6b43ef879419fd9c0f5712c
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://45.77.76.224/~clinics/sObDSpisJ8vqe
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2532-24-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections