General

  • Target

    272-67-0x0000000000400000-0x00000000004A2000-memory.dmp

  • Size

    648KB

  • MD5

    e0c34aa85f34d091d876a93c10731756

  • SHA1

    c1fdd9e7e8067668d90fcbdde2e33908c8948624

  • SHA256

    c25e5b4737d822d640897934f40360397efda9cd1fdc02bf1c313a4f93a98273

  • SHA512

    d81c8cc5d8a0ffd156e0411e46953d76e6536816585ca40d726ffc4c6676ba168edb899e64a9579c149d1ad6f337622cac2381d3fb2327bcf390b6a744b4c58c

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

Score
10/10

Malware Config

Extracted

Family

lokibot

C2

http://185.246.220.85/biggy/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 272-67-0x0000000000400000-0x00000000004A2000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections