General

  • Target

    5068-149-0x00000000008D0000-0x00000000008FF000-memory.dmp

  • Size

    188KB

  • MD5

    6395a44500a3154f5995f5de64f82f5d

  • SHA1

    75b2eacd87e775210a9108a160f17de1f0ce6c1d

  • SHA256

    351c0f59bc98b0011bb831800f8302631a2f7226746749f6cc18ccba5e23310d

  • SHA512

    9350caa82e55d68732a8ece8d31c5c724f228e0c6bc247fad8fda518c4f1cf6d152267b05865095e89fe9fecea2b13994c71c418b81f4184d9604f9ecc9f1959

  • SSDEEP

    3072:+BCkJokjrFdaj33djTqO/8Jqa4vxgEsM+W8iMoGp0eF+oYM:+BTKHdPqOUJqa4vafFiVGp0eDV

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

en27

Decoy

plxfgj.com

lesmarines.online

vacationsme.us

275by.com

bigrodoc.online

xjvcwszbwzd.top

redplanetinc.com

vinyuup.xyz

newbrotherprove.top

219961.com

ompelimosormustin.info

againstaffiliatemarketing.com

beautyrealmm.com

goldentickethomes.com

topfunnel.today

peacsolutoins.com

sztzywygl.com

allfishingtips.com

rcgerlnterac.com

tasweeneloragahar.info

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 5068-149-0x00000000008D0000-0x00000000008FF000-memory.dmp