Overview

overview

10

Static

static

10

4200-143-0...ry.exe

windows7-x64

1

4200-143-0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    4200-143-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    808024d0555017d2f28c77053123c0a3

  • SHA1

    64e9f8c8545caef4cb2c8f7059c0692d186fd9d8

  • SHA256

    8291aec185afd762abe994e026bfc0ba9c1341084219865291542bc6250bfd14

  • SHA512

    658267833303b41fb4e32b0c1bd84295600a5fbaeaab24aefbc0f49cd77f07dbbf5389c4a3ca403c4945e61e2c5b8085afbe278c5bd63d59a8623aed8be76084

  • SSDEEP

    3072:R8QnUQwBFKRujtBxb7ZMcR0j2Rg8GYFsh9h2mQlufoRR84gHy0QtHnqkQ:VNFuHl7ZMcuj4K9CufoRVgS0SHc

Score
10/10
ratcs19formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cs19

Decoy

asafkozmetik.com

hitcentersinc.com

healthcurezone.africa

umzontsundu.africa

llklkj456.online

simplyfetchingweddings.com

agile-workforce.com

efefcapricious.buzz

natalyrunner.ru

alain-jp.com

uhdtubesex.net

amerika-express.com

evolutionunited.com

digi-eye.app

10086o.xyz

airinsystem.com

fullbasketballacademy.com

kronoendustri.com

kujzap.cfd

ankleswelling.site

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat

Files

  • 4200-143-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows x86


    Headers

    Sections