Overview

overview

10

Static

static

10

2412-62-0x...ry.exe

windows7-x64

1

2412-62-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2412-62-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    44d16d7a26b51cfc87011655ff104582

  • SHA1

    7d907412a352a684d1945b00e78c0fcaca84db3c

  • SHA256

    265fe53ea8708444c7de5404b04c92a52a7f721fd1415c75304d40342c8fbeae

  • SHA512

    8f8ee3d87c1f4dc03fc93af3056699913d185fdb06af048837e11d95c5eee83e2f492d1cd87f001347f659f1dacf41927d748085adc0da346349840a4f5478d2

  • SSDEEP

    3072:bNF1k7QVS7zc33F2ifPaBMgaTjjlWEas/24cx+7I7XMh/GUTws:0+HFpfPfgaTjj2s/ncx+dGUTws

Score
10/10
ratau22formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

au22

Decoy

thirty4llc.com

gfoke.com

umso.community

grupoaguiaempreendimentos.store

dvineshirts.com

pbrcenter.com

bruckerproperties.com

amreeshchandra.com

wel-cote.com

bigeasytripods.com

pbwyx.com

honeyburnx.com

matiamahal.com

yummyhairproducts.com

2025yh.com

williesales.com

philoslabs.com

stayinwhaus.com

takingstepswithme.net

cdstss.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2412-62-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows x86


    Headers

    Sections