General

  • Target

    1108-64-0x000000000041F0E0-mapping.dmp

  • Size

    369KB

  • MD5

    31827afb0d7e09d3f4a7afd2e18bc187

  • SHA1

    826b769a959f2cd42b2cdd85ba11921a0f4827d0

  • SHA256

    277c14d393adf2d879e5e5573dfd1f53d6b5b17a33d56ef059e08585f7a99b29

  • SHA512

    064fb576f4304e8f9731121c414557b410d2512f867f19a4dc7420190fe74a8ec5a56f32a03348455531abf54dce6c84687de347ff49779a336359d6e8ccf9e2

  • SSDEEP

    6144:LWV0Bmn3KsyEgT9VDmC10BwUnWV0Bmn3KsyEgT9VDmC10BwU7:Q0Bu6t9VyC1i80Bu6t9VyC1i7

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ko29

Decoy

citusdig.site

ecomrise.store

aringtonortho.com

plan-indonesia.com

retreat-to-the-alps.com

themerchperch.biz

freshfashiondesign.com

zachmizrachi.com

machomancoin.site

racunhariini.com

13378888.com

landofnd.com

techactive.digital

yourdebttips.com

www147171.com

xraino.top

willshouseofhorrors.com

redfiree.com

cyanband.com

srbs35.com

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 1108-64-0x000000000041F0E0-mapping.dmp