General

  • Target

    4136-138-0x0000000000000000-mapping.dmp

  • Size

    374KB

  • MD5

    eb5e467d41127e61ddf6ea126f974efe

  • SHA1

    d880fa6238f62497413e6e643f6f4dfd28a819c7

  • SHA256

    0019e41203494031b41fe2b121db4cc36b776997f3707ad0bbec19c50090f806

  • SHA512

    07e1492dbb70251001d5286892bcc091b80938a6d33a751178dcb1f1c1097b0280014a131018554fc4faa8ca6e1ee5f48c8876ea3df6d4071772d173241eef4a

  • SSDEEP

    6144:emHvEJT0l/A7GbqgQiQAmRSMbDMDMUiDb469omHvEJT0l/A7GbqgQiQAmRSMbDMO:5EJs/yMQnaM3MDfiDb39vEJs/yMQnaMr

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mh76

Decoy

healthgovcalottery.net

wenxinliao.com

rooterphd.com

bbobbo.one

american-mes-de-dezembro.xyz

mintager.com

thespecialtstore.com

wemakegreenhomes.com

occurandmental.xyz

fidelityrealtytitle.com

numerisat.asia

wearestallions.com

supxl.com

rajacumi.com

renaziv.online

blixtindustries.com

fjljq.com

exploretrivenicamping.com

authenticusspa.com

uucloud.press

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 4136-138-0x0000000000000000-mapping.dmp