General

  • Target

    1408-64-0x000000000041F020-mapping.dmp

  • Size

    369KB

  • MD5

    db59d461282ac487bdf293e2c88b9983

  • SHA1

    107ea7a12e6de650b13204405089ea1a8caed055

  • SHA256

    8ad433589fb9fb2a9336ca6398e8278562f41ddc234843c6f9155e8798fb5368

  • SHA512

    bd541b80f95e2294f5da698d50d0d68ca15525981a285b79b630145d2cfe528bb29a7c2dc1d7ae89d2b7192e9c141ed2306c0b77264343ab74613e9753100669

  • SSDEEP

    6144:IypRiX7FJmsw7D74NEJr2nUWWaMw5akypRiX7FJmsw7D74NEJr2nUWWaMw5aH:IsiX7vqIGh2tWaMw5DsiX7vqIGh2tWaC

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 1408-64-0x000000000041F020-mapping.dmp