General
-
Target
2696-36-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
7e737874de86fa346110ec23ac24a81f
-
SHA1
21e22f8d2ffca468d323726b4b5fcd311e35db24
-
SHA256
09df21a685496ff5bb83f67808ee5cd651cd15301fea06abd1605742f4fb0edd
-
SHA512
2b00f8dfca5904e9f1c362bc44ff58160b401c0c38c8fb8d1701ef9bb713a1bb19f623e462ae7b01ecf776d2983d315e96833c7f3b41467032b6991f52e22de8
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqXIzmd:nSHIG6mQwGmfOQd8YhY0/EOUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://rocheholding.top/evie3/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2696-36-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections