General
-
Target
2832-15-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
0f530f097e1280e7caebcf15eb20f07a
-
SHA1
4088be64522dc8fe48f4cb65b6edc26be68a486c
-
SHA256
6b2940e010ad30ed7bbe59fb1a567a42477edd1d768f6d2b78891dfa54ef2511
-
SHA512
e7323911ca32a7b141b284c6e5091ecfc621c471dd54ea83acc2b81c4ec5db0a62f623433d6f2af790a1c8d30a352b0814ad1cce7b30015239c03dc95b9353ab
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://45.77.76.224/~clinics/TWnwcu578emCVQ9B
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2832-15-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections