General

  • Target
    Bakuras.exe
  • Size 295KB
  • Sample220216-dj2bxabca5
  • SHA256 9ceceb144ec9613aaef8b7e653711623f17e6e983abd50f5c47fda97f87e9549
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • b1s5

Decoy
  • stockdistance100.com

  • bit-latino.com

  • paradimetempest.com

  • budgetmdfdoors.com

  • huacadao.com

  • rezcoat.online

  • p1122.com

  • tongtaigj.com

  • gashouseweeds.com

  • statewide-inspections.com

  • fan1234.com

  • shishang.show

  • metaplumbers.xyz

  • yaojiaoks.com

  • sowiesoverzekerd.site

  • navifoil.com

  • goodlandfabrics.com

  • leongeo.com

  • happy-planet.space

  • inproinfra.com

Targets

    • Target
      Bakuras.exe
    • Size 295KB
    • SHA256 9ceceb144ec9613aaef8b7e653711623f17e6e983abd50f5c47fda97f87e9549
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks