General
- Target Bakuras.exe
- Size 295KB
- Sample220216-dj2bxabca5
- SHA256 9ceceb144ec9613aaef8b7e653711623f17e6e983abd50f5c47fda97f87e9549
- MD5 39ee14723774e66da455a4e612c90b96
- SHA1 e23d5d7df46ebb0df805d5263cf9f2f96ddcb82f
- SHA512 854d1a2088c175964edffeb0aa170167ba759c397b83ad850c1e1d382ef0d0aae62a2804b6bec2ede1bc4be9bf6fb28886e1adf5e35d1cd2e7fefc65424a0b17
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Bakuras.exe
Resource
win7-en-20211208
Malware Config
Extracted
-
formbook
-
4.1
-
b1s5
-
stockdistance100.com
-
bit-latino.com
-
paradimetempest.com
-
budgetmdfdoors.com
-
huacadao.com
-
rezcoat.online
-
p1122.com
-
tongtaigj.com
-
gashouseweeds.com
-
statewide-inspections.com
-
fan1234.com
-
shishang.show
-
metaplumbers.xyz
-
yaojiaoks.com
-
sowiesoverzekerd.site
-
navifoil.com
-
goodlandfabrics.com
-
leongeo.com
-
happy-planet.space
-
inproinfra.com
-
siegeofjerusalem70ce.com
-
33y319.com
-
audittheofficial.net
-
edezaflores.com
-
gameofstones.info
-
yuanchengjob.com
-
otfextk.com
-
pf9w3t.com
-
myshop-document.com
-
playism.xyz
-
futuremoney.asia
-
dyrinelcom.com
-
ilu2.store
-
h2prf.com
-
metaversemediastream.com
-
dccannabisfestival.com
-
vajqd.icu
-
mvb2d1.store
-
bean.info
-
drjalili.com
-
berliner-sektfestival.com
-
kas-assets.net
-
defokai.com
-
soundcheer.com
-
yxpha8288.club
-
matthewcremeens.com
-
agoraretailco.com
-
ipotick.com
-
babycollectionz.com
-
myselecthomesac.com
-
cityofokean.com
-
radiochaffd.xyz
-
yearnewg5.tech
-
facebookviolationpolicy.com
-
27266.xyz
-
shopnewclothes.com
-
innovacond.com
-
magnoliabygigi.com
-
adeptus-astartes.net
-
pusceddu.online
-
laramie247.com
-
to-mag.com
-
kfnlaw.online
-
multiversesearchengine.com
-
tg-vulcsite.top
Targets
-
- Target Bakuras.exe
- Size 295KB
- SHA256 9ceceb144ec9613aaef8b7e653711623f17e6e983abd50f5c47fda97f87e9549
- MD5 39ee14723774e66da455a4e612c90b96
- SHA1 e23d5d7df46ebb0df805d5263cf9f2f96ddcb82f
- SHA512 854d1a2088c175964edffeb0aa170167ba759c397b83ad850c1e1d382ef0d0aae62a2804b6bec2ede1bc4be9bf6fb28886e1adf5e35d1cd2e7fefc65424a0b17
- MD5 SHA1 SHA512
-
Formbook Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext