General
-
Target
2624-30-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
f62be8d52c7f9669b92ec65266575378
-
SHA1
c5cfa8389387945e9885b3299332f71e87f8e672
-
SHA256
e40a5dfe7bb6f5775d4b3f55f08e5d3852d884edfeafec489a7412bf9364ba05
-
SHA512
8673f5cb334905af69b26b99d0ba34730df9c75c2fd5976ae7f223f47b10aee6a704ea5f409d8553198f8168808c927251e4c83b438184b2c85528e16d72ac9e
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqyIzmd:nSHIG6mQwGmfOQd8YhY0/EHUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://sempersim.su/d9/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2624-30-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections