Overview

overview

10

Static

static

10

4100-127-0...ry.exe

windows7-x64

1

4100-127-0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4100-127-0x0000000000400000-0x0000000001783000-memory.dmp

  • Size

    19.5MB

  • MD5

    ea7c4228b2098a14832aecd3ba0b60fc

  • SHA1

    6a7aea945fd849b41305b7b5d79240f10f330998

  • SHA256

    82a4cff61a02fc6d4bffee09d48c71c87f8cc3d94f36215e0d6b9efdad94ec28

  • SHA512

    63441e69a640d8130fcbeecf8b6e1b78e00b60fadd90d6070f6c6427cd7adc0776e09e523469110b9d017f502b226f09e50c03e6ea7742d75e49769b5ecac4c3

  • SSDEEP

    3072:4hIg39FjjoLA9F874bHeCg5bHEA56e83uCXzzUbP2CPb4Tld1fT0VfN2t+PHM:1YjTRbHpabkw6H3uCjgTRg1AVfU2M

Score
10/10
ratxchuformbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xchu

Decoy

zcartoons.com

castilloshowroom.com

3bmmdtod.life

misaxoxo.com

nadiya.online

sykkbup29.xyz

triciaaprimrosevp.com

newleter.com

ptzslk.xyz

lightbulbfestival.com

texaslandline.com

ideeintemporelle.com

girljustdoitpodcast.com

medimediamarketing.com

bunk7outfitters.com

charlievgrfminnick.click

lifestyleinthehome.com

atfbestsale.online

frontdoorproperties.co.uk

grandpaswag2024.info

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4100-127-0x0000000000400000-0x0000000001783000-memory.dmp
    .exe windows x86


    Headers

    Sections