General

  • Target

    544-68-0x000000000041F1C0-mapping.dmp

  • Size

    371KB

  • MD5

    9665d5b5b1eafbed808edced83181178

  • SHA1

    e6ec9b38fd8f2d7cf76a8431c91556f5c3d99817

  • SHA256

    7424dfad7eb863216be29551abc5b34195a62b98a2327cc45eea02f3fee68186

  • SHA512

    f7edfa0c745a4c67666c62b3aa965bc015e6900ab8148a7d23b4e451c18ca79896b58899c6172b9e3385c6dce5cd8341ee8d0cb23d70aae565ba3db0d7a1ce2b

  • SSDEEP

    6144:XfCWGCb6J4crO+ww+M7X7UwfCWGCb6J4crO+ww+M7X7UU:KWGQsaw+M3EWGQsaw+M3f

Score
10/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cy01

Decoy

beauty-clean.site

funsellers.shop

digichatbox.com

greenleafpestsvcs.com

getcashs.shop

jessbenitez.net

bridgeworksmotcentre.co.uk

chorusmobile.africa

kiralayolla.com

ft-vip.club

fromlearnerstoimpacters.com

baldwinaesthetics.com

legacyfinehomescb.com

adnaturaltours.com

hzdingyushangwu.com

brinkworthchurch.co.uk

statesurvival.net

beingabroad.store

gmkmc.com

toubra.africa

Signatures

  • Formbook family
  • Formbook payload 1 IoCs

Files

  • 544-68-0x000000000041F1C0-mapping.dmp