Overview

overview

10

Static

static

10

1624-67-0x...ry.exe

windows7-x64

1

1624-67-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1624-67-0x0000000000400000-0x00000000004A2000-memory.dmp

  • Size

    648KB

  • MD5

    317fb83461a41acae088aa5d66d8d2ba

  • SHA1

    8762888f50e452441b587860a9558c8dfd52cccf

  • SHA256

    91a65331ee2f92e50de364628cc7a7253940a54f1afc289774f4fb275e443964

  • SHA512

    b066f037247028df2a39bf210c0eeb7c0adb908a585c40adfc7179388d4eeb5059253ba6acb317cb36da6324e710b8f0ec8cd67f0858cadbaf307c65e05fa4ee

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqRIzmd:nSHIG6mQwGmfOQd8YhY0/EAUG

Score
10/10
lokibot

Malware Config

Extracted

Family

lokibot

C2

http://rocheholding.top/evie3/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot family
    lokibot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1624-67-0x0000000000400000-0x00000000004A2000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.