General

  • Target

    2032-68-0x000000000041F1A0-mapping.dmp

  • Size

    369KB

  • MD5

    076f22f4e6fb9d0714e6de8092a8545c

  • SHA1

    45ef8c20109a979dcb0bf8a7715354227d1fa371

  • SHA256

    dd54e3d9411d06f000d55dbd019ca49bf291e390a10393f0847e1e267b898a5e

  • SHA512

    8cf8aa973ec71ab6d0cd907ddeaa72dfe8d7d5177180ff97ee7eaa64e0d602e68854ea509421c45296ff398e336deecc27b2a031e2b7b67a49885fb61a450549

  • SSDEEP

    6144:rQqWc3tCvr7HXJ6V3xnD6IpKkQqWc3tCvr7HXJ6V3xnD6IpK4:Ei3tCvngfDbK9i3tCvngfDbK4

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

a20e

Decoy

pushkarinidigital.com

e-shiryoku.com

sendmeblog.website

arniepalmer.com

tinnnitin.click

serummoctoc.online

chmoptk.xyz

kidskarpentry.com

wanglin123.com

onlinecannabis24dispensary.com

hkwx8.com

marcrosenkrans.com

bridginglegal.com

a2r2.cyou

app365e.com

semesta.xyz

encuentratucasacr.com

huiyusc58.com

carnivalofmiami.com

functionalbreeze.com

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 2032-68-0x000000000041F1A0-mapping.dmp