Overview

overview

10

Static

static

10

1748-146-0...ry.exe

windows7-x64

1

1748-146-0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    1748-146-0x0000000000400000-0x0000000001654000-memory.dmp

  • Size

    18.3MB

  • MD5

    3e50746ae1702f95acdfd7b10ad1abed

  • SHA1

    6069eb898d895ea89ec1bb218e438ead38f4b584

  • SHA256

    0eb3042f2bf0242a1639d26d8fc2f411da3d1ed3a6f00581b41c3ba5b7f11725

  • SHA512

    4ff73f38ba77e252a891da7802c180696b9582775d6539e3b958c87c29a0b9ca6f4114118423bb99252247f15d6cb3c3c320708b1e95d17e0307c6c4d8db9822

  • SSDEEP

    3072:CgrEmBwv/dPfW3+g0A/ocqBa4hRhtRTRPF7wxuGxZm/wfuUQdNs1LY:lMA+JA/fqBa4hRh3TRPtQx7QA1Y

Score
10/10
ratbb27formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bb27

Decoy

californialivingbenifits.com

lifestyleisrael.com

fmgy.love

theresidencesparis.com

divers.pics

flezibuy.africa

kalidaddigifirm.com

herbal-nutrition.uk

zaiana-store.com

702thrill.com

justfoodup.africa

ebctec.net

cansucudesign.com

qy-zh.net

siokul.xyz

mustech.africa

haber-apartments.com

camilaandrademakeup.com

home-decor-86543.com

fzui.xyz

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1748-146-0x0000000000400000-0x0000000001654000-memory.dmp
    .exe windows x86


    Headers

    Sections