Overview

overview

10

Static

static

10

2520-140-0...ry.exe

windows7-x64

1

2520-140-0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2520-140-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    c16b2050a939eb86fbf53818588958f8

  • SHA1

    947d0542d04f10252f05a858f3c21ae3005f6c8d

  • SHA256

    831417bbd0f711016832ccd1d1a0282c127c5d3f63c7dd6161f2730884c6b5b4

  • SHA512

    153de8acd6a1f72d497d5c9e3e62c7f44f9893e20e97d7d98dfd3be06328e036b2c0c3d72af2577b7b874374b6ec8ccc92621f323a7ccf6ac0270811f436a48f

  • SSDEEP

    3072:H4HdEoiq8GQwA3hmXj4p3xaLTY47q+L/H2MT/DFmXuiNuxRIiLOj:zGOhsjiBaLTY8/WMzh2uiwui6j

Score
10/10
ratsn26formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sn26

Decoy

resenha10.bet

gulshan-rajput.com

xbus.tech

z813my.cfd

wlxzjlny.cfd

auntengotiempo.com

canada-reservation.com

thegiftcompany.shop

esthersilveirapropiedades.com

1wapws.top

ymjblnvo.cfd

termokimik.net

kushiro-artist-school.com

bmmboo.com

caceresconstructionservices.com

kentuckywalkabout.com

bringyourcart.com

miamiwinetour.com

bobcatsocial.site

thirdmind.network

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2520-140-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows x86


    Headers

    Sections