General
-
Target
2292-8-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
79dc4accd15511847a822f017055cb51
-
SHA1
81302cc0fed75fea816721b58588cd40294b6514
-
SHA256
f5a49e0802e34edc7ba75a7d5986aaf49785d7a2cd909ab923e07bf597bf3257
-
SHA512
4f4f123fcee933b47f02735c46360957f726fd58d0d3dda1d246591968fe7da24ec4e535fdcc3325e5fc78869a1e2070582b9357d5930dc48c27586238f6c84c
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqIIzmd:nSHIG6mQwGmfOQd8YhY0/EFUG
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://45.149.241.168:4410/fujfygidj/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2292-8-0x0000000000400000-0x00000000004A2000-memory.dmp
Headers
Sections