General

  • Target

    980-64-0x000000000041F1A0-mapping.dmp

  • Size

    369KB

  • MD5

    a5f8c285814bfb08e85174ab88b87fb2

  • SHA1

    7bb9e4793c14c177cccc8cb3133824c21f05ce5e

  • SHA256

    7c011e0d0650050f27cb927dab094a176d2fb6483ed8ee75f0ed8350494a65fa

  • SHA512

    f487c0804362591edaba6303598943ae54ea77815454e48bd54e92240db0c741e659effa8947ced4b814e16c677cee021a64d1c26c85c2e41d7da231f0530d82

  • SSDEEP

    6144:hvB8QL2O+W7nBFKT60xy5ZF9tvB8QL2O+W7nBFKT60xy5ZF9t:ht2O+c860S9tt2O+c860S9t

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

os56

Decoy

australianhotwaterupgrades.com

vipidplus.online

kneescooterscanada.com

pesanterkini.com

madden24gameplay.com

linkbong88moinhat.net

awongtest41saletest.com

thetravellingcatcompany.com

vazxlip.xyz

bangdemcheeks.com

passengerassistance.website

cloud4global.com

prestopizzarennes.com

midlandchambertravel.com

nashwan-d.com

bellescraftkitchen.com

teamtisdale.com

allascooussaa.us

cryptobet365.xyz

cbij.education

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 980-64-0x000000000041F1A0-mapping.dmp