General

  • Target

    4972-287-0x0000000002F30000-0x0000000002F5F000-memory.dmp

  • Size

    188KB

  • MD5

    331d5377bc212839775e4e47a5fa2a02

  • SHA1

    68035ea6531fe26fa6321161de724073e98e774c

  • SHA256

    d1cddeaff97e7580e806b911117e78f7f1ebe7aacc9254889e998704cf12a624

  • SHA512

    52788a8b10bf5329ae3a9ea9a3452013bd60dfbdf95a589c8c4ac5793cb22d54a8b5bd9f0af62e4494f28ec68110205768e18abc1814983cb762ce52fef87a5e

  • SSDEEP

    3072:E2MvBkKF1wvzJ93ikcMZ9Xa22zNU2sMdEJjuSOVqRgcanfv1tfGHo06nBIw:KmxilMZta22zm2VVEZGGI067

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

wh23

Decoy

ow9vyvfee.com

alvis.one

mutantgobz.claims

plynofon.com

southofkingst.store

nuvidamedspa.com

coffeeforyou56.com

opaletechevents.com

momobar.life

abcmousu.com

learnicd-11.com

tipokin.xyz

kahvezevki.com

suratdimond.com

oldartists.best

infoepic.info

mattresslabo.com

skarlmotors.com

cl9319x.xyz

med49app.net

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 4972-287-0x0000000002F30000-0x0000000002F5F000-memory.dmp