General
-
Target
2032-14-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
4c5afbf9523fbe3daacea7d940e2eba3
-
SHA1
6e1e837638517e5680d44b47dca1521c502dea82
-
SHA256
4b0c5b8eb014902b816c8198bdc562daf5fb30894918599c9bf366a34a3f8fab
-
SHA512
dd3e3b5c3b225d721f1faf8f214cf60e1687138625ed318b54ea157e410e496c312faea3c97c4442563adc697a16f8c1d93f8b8a4c5ba9a83b6673803d58f50d
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/Eq0Izmd:nSHIG6mQwGmfOQd8YhY0/EJUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://sempersim.su/d6/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2032-14-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections