General

  • Target

    1380-64-0x000000000041F120-mapping.dmp

  • Size

    369KB

  • MD5

    53435f7344211814a65a8a783b3c42dd

  • SHA1

    264154daa21f664e45dae4db4c893bcd77fdc5c2

  • SHA256

    444b72226751d5ca777d8c47fa9cde52dcf1088b16132d145f7804be939fd6e4

  • SHA512

    eca391243dbb573a0551264f5b4270d7d51f04e45f78aa4dcf60ebf7f39460926e5683a9d7d747e78530e3d76c1abe93374981badb90ba2f97bf83838dfdb6c6

  • SSDEEP

    6144:zxPsYywKsB+fta7Zgk+RxPsYywKsB+fta7Zgk+B:iYyTugk+oYyTugk+B

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ss63

Decoy

heartgroupfurniture.com

petruskraftshop.net

bernesespirit.com

minulgul.com

canoncashier.com

britishsaschool.com

frau-kruppa.net

cj-zn.com

derdggyih5ctsc.kred

xvvbros.pics

unacucinadipasta.com

brandsalted.com

pledialinks.xyz

teslamoto.shop

doxycyclin.monster

nuflowalexandriava.com

eliteinfratech.com

laymember.net

bestprobiotics.online

diversifiedpower.international

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 1380-64-0x000000000041F120-mapping.dmp