Overview

overview

10

Static

static

10

2804-12-0x...ry.exe

windows7-x64

1

2804-12-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2804-12-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    0ee87addd0b8e73606989ab03678fc85

  • SHA1

    c0c0aa39add40478193876c4de5d0d2164d1f22b

  • SHA256

    f73a790ef41aad73df1d8a888e8947a55e3eb39b6d3cdd744998d4b78b3533c5

  • SHA512

    c66ec3830c10ca6a55204b3fa69fc8ff022d6d75e8d1a5a29b73f51f9fd7ae2655a09dbdcd6fd756205eeac561c77b9d732bfd875300e30d3193dd5bb71f7bff

  • SSDEEP

    3072:NQWhEXDWZwFf3LTQyeZPLvCxP/q8lCrkU5yi873zrNl:lknfLU1LvCxXq8lCgUp873zx

Score
10/10
ratu1r9formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

u1r9

Decoy

brightlegalclub.com

90008555.com

nakedfitness.club

asdfcdxsz.link

ocp9z047.click

1xbet-znx.top

takmeeiiom.online

loveofacoffee.com

elodieshiatsu-bienetre.com

waijaihome.com

loanslatvia.today

nbdgt.club

celicrt.online

onsitecomputers.net

learnwithfad.com

civilservice.app

grecoemploymentlaw.com

7780to1.com

ontimefishing.com

extremepaverfl.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2804-12-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows x86


    Headers

    Sections