General

  • Target

    1372-80-0x0000000000080000-0x00000000000AC000-memory.dmp

  • Size

    176KB

  • MD5

    681b4c5d84e1a0e4bb10731396ca20a2

  • SHA1

    69f090a14f66f87b2adda48d59c07c4770fc463e

  • SHA256

    9dffd364065979f2ad53466daf1643f7840757d9f96a0eee02039672dce17de6

  • SHA512

    ca6d9d30feb475206bdee20f101978dadcb842304e87bb95b7f5a99f322e54ec5c25b0cf60a200a7ebfa0325651070c565494d3902ea2a98f4ed20c383963ab2

  • SSDEEP

    3072:m2TfMHm2AoRXWTJdpTcn39UcX/qEicC67ghQRP:jLWRcdho3ScX/qEicC6khQF

Malware Config

Extracted

Family

formbook

Campaign

u8ow

Decoy

uzhDDUNgg10rOh8rkUMGYiLuNnRWl9gwMQ==

bfkA4IUaSgYi7IA=

ezX5yHeR21O3h2RCgQ==

x3E4ntHeLMGQm0kdTi6PJtjOVS6Em8UaKA==

xJuAYwcZLAfqrVazWjvkirgFxDSf

qrGugLdannLYegX5dCtFMA==

i61nMddueAYi7IA=

RoNMKNhtdDWpeiYoaB37TPiHTLo=

RFj3UHHrDtAktSZhYku36opnsaMbNA==

lx0g+6RPl4jwwNPRPuTD

MyEQ4oGk6vXrMM4V

0IVWH0rfKe1J4nn6J9XB

SYVlN3Zrnq2OaWpDiQ==

fNa0jy3P8KQK25rpmwqd0t8=

UZuSZpW+9ffX9KXzmgqd0t8=

Vxf85YCWvYNZjkcDdCtFMA==

0gG1EzLP7/DrMM4V

WExRGVAEE6YS5tJkTxMhR636+A==

6Tv7U4QdURt1KUI+gw==

ooR7RXgsXPtaEutnaQ3efjIXmfJePavzIA==

Signatures

  • Formbook family
  • Xloader family
  • Xloader payload 1 IoCs

Files

  • 1372-80-0x0000000000080000-0x00000000000AC000-memory.dmp