General
-
Target
1620-16-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
36c57996311ef417e65852ccd69cb4d8
-
SHA1
1260c23a708f4c1782824bb12ffbeb9069d5840d
-
SHA256
7765175611192c351b0ab067b1a653069338bb05beab409037742f413b116740
-
SHA512
8b381e270b956998c67f636ff8bbf8c34d9a73512f95e8424221790ac3356c8d204e3645a83f5d401283ae358d465d3e48e5919fab5a782459e18508c0bef047
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
https://sempersim.su/b14/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1620-16-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections