General
-
Target
SecuriteInfo.com.Variant.Bulz.305305.30259.15684
-
Size
789KB
-
Sample
210114-7c94b73pja
-
MD5
d2243853349a89f7a109888a8a757d30
-
SHA1
6edb7255d8affee8a763844b22542f699f721a69
-
SHA256
d5a16e5b25db8bece713af0963f126349dda1dbfc13d03f678a14ce618037ee8
-
SHA512
940cb1d7b8e7bf9a6f14b54d65cc292555c2f97a741b47436ae61dffb1c65ca16f7a821befa073497ab3e508d28d8bcb0ac5ca90b8dffb4a8faf9a02cbf67341
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Bulz.305305.30259.15684.exe
Resource
win7v20201028
Malware Config
Extracted
lokibot
http://paciflxinc.com/zoro/zoro2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
SecuriteInfo.com.Variant.Bulz.305305.30259.15684
-
Size
789KB
-
MD5
d2243853349a89f7a109888a8a757d30
-
SHA1
6edb7255d8affee8a763844b22542f699f721a69
-
SHA256
d5a16e5b25db8bece713af0963f126349dda1dbfc13d03f678a14ce618037ee8
-
SHA512
940cb1d7b8e7bf9a6f14b54d65cc292555c2f97a741b47436ae61dffb1c65ca16f7a821befa073497ab3e508d28d8bcb0ac5ca90b8dffb4a8faf9a02cbf67341
-
Suspicious use of SetThreadContext
-