Overview

overview

10

Static

static

10

2604-13-0x...ry.exe

windows7-x64

1

2604-13-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2604-13-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    6f6ebaae569881df8c077b6c72c361e7

  • SHA1

    1be5cb394fed9732c17fee45486cdfaa3392c2f1

  • SHA256

    c4415a5505dabd9ecd53d05f8af48b03106aed45b5accb7c1f10dd9855e5a72c

  • SHA512

    0ba4d43229512efc09bf1156f553fd554376aed46f02dc60a9b3ab848181b33f8bbfa81a98f4c51fc5df1dc275a99bfb07aa2c633b9b2a87a2fa96593981220f

  • SSDEEP

    3072:d0pE1jao/wruV338ZsqtdK+XyJk0hRHhnQyb8MBNzK5Qgm0t:TaL8H8mqHK+XyVFNoQp0t

Score
10/10
ratvl53formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vl53

Decoy

bushypussypi.com

alzentori.com

pearlmassagecentre.com

zag6.com

workadumail.com

ferreelectricosdaniel.com

takethislolypopo.com

maylanicornier.com

nptstudio.com

dunasgolf.com

guangshangjituan.com

cj6p.lat

camloi.xyz

goldcoastkayakfishing.com

hiasannatal.site

safesnipper.com

adamssecurities.com

productizewithmalu.com

oral-nursing.online

adultproducts.top

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2604-13-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections