General

  • Target

    1684-59-0x000000000041F040-mapping.dmp

  • Size

    369KB

  • MD5

    2d5c25193a0493723278c2874467fbb0

  • SHA1

    306c98e37c416b141ccc3a6aa57ef8f6b5102e36

  • SHA256

    d82f218ab0879c827ec8e47396a67e0a54364017786bbb18f2c8512cf0cd803f

  • SHA512

    3eae54feea844e24106bc76332de58af01f0ca5335e1603370391a34f812ce65ac775274617cba4221a77fe727f9afa79fda775f6a3f7fc0d578361906d5af49

  • SSDEEP

    6144:FtsAZQpLKHL2+MnoXOuZTtUIXThUtsAZQpLKHL2+MnoXOuZTtUIXThl:QAZwJ+AeOCTtbjhHAZwJ+AeOCTtbjhl

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gs12

Decoy

axie-connect.shop

limitlsesbook.com

kupit-diplom-v-msk.com

bvmgmt.net

katejewery.com

dobuy.club

angelacasado.com

kozainvestmentgroup.com

wellplayedarcade.com

081kai.com

hnctsw88.com

pilingexpert.com

bettertour.online

costuraponto.net

khione.ch

thepathifollow.co.uk

84421274.xyz

alko-airtechnology.com

gherservices.com

dllmbookkeeping.com

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 1684-59-0x000000000041F040-mapping.dmp