Overview

overview

10

Static

static

10

936-76-0x0...ry.exe

windows7-x64

1

936-76-0x0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    936-76-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    94fc6d10579d582a9fc2582d1b8f8619

  • SHA1

    eb5f0a9128cace144e5510fd1ca8a8063e76eb50

  • SHA256

    fa25282be8cd4fed184acd365b2151a55ab53d203b6ea46a6b9f2cc115f6eb19

  • SHA512

    19e645711ced84188abdad028c3cca2619e2f1f0ef1b1f36b3df03cbdc056b2664260695bead22d046d1ff48488b42bf298c5cd7d8ba1a679da6071318b2254f

  • SSDEEP

    3072:37dr2BCU3qM/tS7yzpLBwDX6JMr4eN6wok3GDwGpHXwjnG+0VRE:rITVw7kL4qir4eN9P36xp3un

Score
10/10
ratco63formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

co63

Decoy

detectiveadda.com

codewm.com

leeinvesting919.com

dzaiwn.com

winecountrywicked.com

floraldesignsofhastings.com

saleschildcarriers.com

kanspersky.com

mondlyfor.com

takealicense.com

aclarkemcgee.com

riohandmadewithlove.com

petalumadumpsterrental.com

stanislavp.com

mansakesalive.com

ballthingsez.com

iongraph.com

pidesimple.com

nutritioncalculate.com

dulichphucbinh.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 936-76-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows x86


    Headers

    Sections