General

  • Target

    1488-138-0x0000000000000000-mapping.dmp

  • Size

    374KB

  • MD5

    73b839feb7b7e9e280d1670789420f8f

  • SHA1

    53683b32b33d4027cf9c385262bf6db6e0652013

  • SHA256

    b521e954ecfe844e61160f21a8f9b83ad205fa4ae22238d1184690699d86af77

  • SHA512

    73d8b467cb294fd365a7fe72aeebbab55a2320771e6bec1fb4fbfa7fb3150b9b279cc372006a78635b08bb869e00f62c665428617b97959ae6e2ca7a33916885

  • SSDEEP

    6144:fmHvEJT0l/A7GbqgQiQAmRSMbDMDMUiDb469omHvEJT0l/A7GbqgQiQAmRSMbDMO:IEJs/yMQnaM3MDfiDb39vEJs/yMQnaMr

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mh76

Decoy

healthgovcalottery.net

wenxinliao.com

rooterphd.com

bbobbo.one

american-mes-de-dezembro.xyz

mintager.com

thespecialtstore.com

wemakegreenhomes.com

occurandmental.xyz

fidelityrealtytitle.com

numerisat.asia

wearestallions.com

supxl.com

rajacumi.com

renaziv.online

blixtindustries.com

fjljq.com

exploretrivenicamping.com

authenticusspa.com

uucloud.press

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 1488-138-0x0000000000000000-mapping.dmp