General
-
Target
2628-22-0x0000000000400000-0x0000000002434000-memory.dmp
-
Size
32.2MB
-
MD5
b89cbe0631aaa36ffc2dfcc148c9dd63
-
SHA1
a04dfe7f3c9a33f85a6c252e9f062c79b2df3947
-
SHA256
1dcdcf17a133eb2b71480229204c54d57961d4697e1c367b4eb4a72c7060fbc6
-
SHA512
2c60a0149373aacad03248946f6407ce4770f8a5ccbfc282b79d205514bb0a93b53951bf1afd137f7b82656d9c1f52e852ac55e506681fac07713e478b0bf913
-
SSDEEP
3072:nSHIG6mQwGmfOQd8YhY0/EOUG3wKnF2R/Q:ncd6bUfFdXTtUCwKF2R
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
https://sempersim.su/a14/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2628-22-0x0000000000400000-0x0000000002434000-memory.dmp
Headers
Sections