General

  • Target

    3032-159-0x0000000000401000-0x000000000062B000-memory.dmp

  • Size

    2.2MB

  • MD5

    62687e74d0fcf4fa7806aa5d498edf79

  • SHA1

    30dce7472d04390335ea42f908a03ef1e1d55e6a

  • SHA256

    cfa3720ab66e1cc32a4aa3fdcf0dbd8cf1df8c8d13d17b8a7660383abfef4caa

  • SHA512

    8c584ce4e083af71bdc34829fbec3f6e336b5de0e78bccc676045348e5e7911aa152a3be9eeba67d9af5d7c833ef8f71791f31a2d823d09e6f8c7c6df9f909cb

  • SSDEEP

    3072:fSmE4CzQbT6MP3OKoDoRXnWKfL6kWE7zMuvmY9anYeqKyDNJuq6uc48M7qb6:RCzkPOjDwXWKfL650zM9MG4gq3z7R

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

st10

Decoy

fca.rest

du1ay9va4q9gbpp.xyz

698898.com

tiffanybrestpsychology.com

futurepolsts.net

nauticos.xyz

sicp-solutions.net

ashkelon.info

educe.icu

fuyuetaiji.com

31131.top

edify.cfd

waxbarandmore.shop

philaty.com

10484.top

censubi.click

samflorencia.com

chabadoncampusinternational.com

ky6825.com

bolderrundown.online

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 3032-159-0x0000000000401000-0x000000000062B000-memory.dmp