General

  • Target

    2400-51-0x0000000000400000-0x00000000004A2000-memory.dmp

  • Size

    648KB

  • MD5

    a29f3ec2116593b43e3813943681e19c

  • SHA1

    b0b6e495d2e25c1fc051658453ca8b65db30078c

  • SHA256

    8ee435008ef4a1639076a80646e60c4a142165e636c1af99e310b8061e3d3adf

  • SHA512

    a3c1bd056dc210a08fa1817b1efaec34c1d252c491ce54f90d6cee3f98fc37c6054a99e908e39aa48aa18b87ce929681707b26334df589979632c207ce726721

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqdIzmd:nSHIG6mQwGmfOQd8YhY0/E4UG

Score
10/10

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/d6/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2400-51-0x0000000000400000-0x00000000004A2000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections