General

  • Target

    3824-141-0x0000000000000000-mapping.dmp

  • Size

    373KB

  • MD5

    2bfb5645c4076bc7de5018a2a0a7497f

  • SHA1

    8c343283fcd7255489ab276fed14acd09209997d

  • SHA256

    32d7cb3fbc52503e44c9266008a65e466f4c8de560d39e2e4a64a2c949485a63

  • SHA512

    0dbfc654d69ef0d1ee0981c45d7213642cb41d4499cdf811b8b069a493ec0a9c0e450c1e11c831ba6dcbd09a8da3a24e91e13cdef0ed83a9103b793a04faefa9

  • SSDEEP

    6144:E6VPFPdAwTxTrNFIcG70i+nskT9oZ6VPFPdAwTxTrNFIcG70i+nskT9o:XPdAaxRnNn39oAPdAaxRnNn39o

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

nurs

Decoy

caixinhascomcarinho.com

abinotools.com

oporto-tours.com

iruos.com

yesmamawinebar.com

wwwscu.com

habit2impact.com

antigenresearch.com

ux4space.com

diarypisces.com

cryptopers.com

lovingmoreband.com

beerwars.net

ascariproject.site

livesoccerhd.info

bluestardivingschool.com

pluik.com

snorrky.space

lcoi9.com

phantomxr.com

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 3824-141-0x0000000000000000-mapping.dmp