General

  • Target

    588-68-0x000000000041F1A0-mapping.dmp

  • Size

    369KB

  • MD5

    52b055c5acc85683fa7c2b9ad208bae1

  • SHA1

    269239ccaa4d32e056bfd600c4cfe855b06b7d69

  • SHA256

    e824ffd543587f60e2cd18f1f2622e3edc88b023879c5138958de74a511d5635

  • SHA512

    7050b1163f4391ed2dd1b112d49b1f76b6f34a796354a242dc4cb2dc5c146e10349fa9c2637713664c541b4fff1c54105fd601891de8aa662c29bf9ae4079ecd

  • SSDEEP

    6144:LQqWc3tCvr7HXJ6V3xnD6IpKkQqWc3tCvr7HXJ6V3xnD6IpK4:ki3tCvngfDbK9i3tCvngfDbK4

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

a20e

Decoy

pushkarinidigital.com

e-shiryoku.com

sendmeblog.website

arniepalmer.com

tinnnitin.click

serummoctoc.online

chmoptk.xyz

kidskarpentry.com

wanglin123.com

onlinecannabis24dispensary.com

hkwx8.com

marcrosenkrans.com

bridginglegal.com

a2r2.cyou

app365e.com

semesta.xyz

encuentratucasacr.com

huiyusc58.com

carnivalofmiami.com

functionalbreeze.com

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 588-68-0x000000000041F1A0-mapping.dmp