General
-
Target
2492-30-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
f141152e732cbba2eef73ee41a532666
-
SHA1
622678dbbf821e6db1688f25d0861c897ea1b6b2
-
SHA256
94f3598d6925033f7a49d3b63a36de24750976ea7251e9744f6001700ebfc88c
-
SHA512
3dcfa4a27905a431e775efd051959c62df9a15cc3c41c4f5431a6839136e7423aa5ab4a76ff06de568fbdd56b847f734d8e098a81636b969e19df85f3ecbb670
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqZMIzmd:nSHIG6mQwGmfOQd8YhY0/E3UG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://sempersim.su/d9/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2492-30-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections