Overview

overview

10

Static

static

10

768-64-0x0...ry.exe

windows7-x64

1

768-64-0x0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    768-64-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    38cf6af5693ea8d3e1b4dee3a140d61c

  • SHA1

    12957c23ff59c0a7aa1c7bf4f98ce33228c57314

  • SHA256

    bb708a049b655e2b00efa463f2c46a49239124aef2a811466df10e555a077c24

  • SHA512

    f5bf403a63878d0207c3f6f279aabfc4ea84332f7ab3696d7e1e8ec71d6404ad5baa17a6a81e6b8c598d3f220bcd8ebbfc9b1ebe14d4a23e14e3cfc2b2f16938

  • SSDEEP

    3072:qOj7kNohQLst13cv4+08HKmU3EtfdJidSGOdLHF0yBODDnh:uoZcw+BHKmU3Etfdk8dLl9o

Score
10/10
ratso23formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

so23

Decoy

evocna.com

africanmoonadventures.africa

immoyoussef.com

levelsjealth.com

galuzaekaterina.ru

facenest.biz

dataclaws.com

hxhss.com

freename.app

rowansenioridol.com

belfiusbanque.rsvp

infracinco.net

jills-life.com

chargegiga.com

dpxqz.com

66y118.xyz

getvidsquad.live

avrupa90yonetim.com

barentspressprojects.com

calmpaththerapy.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 768-64-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows x86


    Headers

    Sections