General

  • Target

    cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835

  • Size

    104KB

  • MD5

    46e14dc04ccfe824f67fa6eb57edd38a

  • SHA1

    74481772cc6c62a20a1ea2ddc7d8b2ff6eeae9b5

  • SHA256

    cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835

  • SHA512

    49f07edbf81a9bf6248a9eadc7110256cd60784f220664cfb634f4ef79d609de2d390b10dd48e678f31193fa3618c8b5fb875f083a0c95028559b40e15a2b9a2

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

Score
10/10

Malware Config

Extracted

Family

lokibot

C2

http://91.243.80.67/ddx/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835
    .exe windows:5 windows x86 arch:x86

    0239fd611af3d0e9b0c46c5837c80e09


    Headers

    Imports

    Sections