General
-
Target
2720-17-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
5cc57598e4a9542db8ebe39fb3ba4b31
-
SHA1
4a33a25d48ef34945e93459350ea2b24aed4466f
-
SHA256
ff57a15db2b780c1c31a92663dd61df9b50c9724ba6c4ef7539e5d9147bbef51
-
SHA512
6d35e11617699ca9962ea07fbe7d6c204cd41b0655d3f30f9b3fefbffdeb23f63f92e33e07c379f3ff44bfeaec14cacbdb2350a6a7815bf0c36825cc0a1607d6
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmdE:nSHIG6mQwGmfOQd8YhY0/EqUGE
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://villar.ftvproclad.top/_errorpages/villar/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2720-17-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections