General

  • Target

    668-67-0x0000000000400000-0x00000000004A2000-memory.dmp

  • Size

    648KB

  • MD5

    2d1b061a9886dc0a98cd843015c9e457

  • SHA1

    95c5049558538593f793c1a87c35af3ab7d06ed4

  • SHA256

    de1b1c59cd40e7374cc1b372ca567dc56c59a5d96eabe14721f228062ae0b5da

  • SHA512

    f09ac8f0361f084ca1ff75831886e5e350ac2e8832e87b61a0c690224bccf355e9fbec0346cc11290a2eadcd4d37dda22135d7daef920fcd4025c995b5845d9d

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

Score
10/10

Malware Config

Extracted

Family

lokibot

C2

http://185.246.220.60/gambo/five/fre,php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 668-67-0x0000000000400000-0x00000000004A2000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections