General

  • Target

    2040-64-0x000000000041F160-mapping.dmp

  • Size

    370KB

  • MD5

    36aea3fd3ef4076b4e554cc6beff998f

  • SHA1

    76b34d3d24dd8263db22ad8c7574db3056aa0744

  • SHA256

    98e804fabd0787bd4a98698f41454b5ba56a1cb2c9f0ca1d3553e4e084627c7a

  • SHA512

    40cc9232198494346f8a86111b787e6887398f6ef4d08c681a58b31fa5cf32afa587980634a0382c7fd79024acaa37b2ef1b73946fb7d4467aa08fc7ec2df54c

  • SSDEEP

    6144:/nX9xLk3q9zd7uUew0kBOXTvnf645xt/SDNNOnX9xLk3q9zd7uUew0kBOXTvnf6X:/Xk3q9B6aOXDS4xJXk3q9B6aOXDS4xC

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rsea

Decoy

aylagrey.com

ketoodavoqslim.xyz

foyfoy.ltd

buymistnow.com

ownempire.net

cie-revolver.com

kedaimks.com

rockbettergear.com

luminousfadel.com

universalbumpkeys.com

enjoyablestopnshop.com

grandesfinanzas.com

professionmessaging.com

thtoughthenight.com

conservativesshop.com

jimihoodie.com

nhlove.net

agentsheila.com

tilemarkng.com

94ei6mgy.com

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 2040-64-0x000000000041F160-mapping.dmp