Overview

overview

10

Static

static

10

3840-9-0x0...ry.exe

windows7-x64

1

3840-9-0x0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    3840-9-0x0000000003450000-0x0000000004450000-memory.dmp

  • Size

    16.0MB

  • MD5

    358737e11766da96658e1f1311b4ad7e

  • SHA1

    42dc55d6a83b4d4c0f4ad7fe8e8aaac60d6e2d0a

  • SHA256

    8274934523224af63ae1b3c220216a1a48ebbd7e267a1d6cfc7c9f933a048034

  • SHA512

    984e9df57ebb8d96f9b51c5ffa3657624d966b2189a4a3bf641850fcd75969c614e90e6d16360a52d66ab5635bd073964cd2be1b31913b086bdaa2d67d65d102

  • SSDEEP

    3072:Wlk4Frz5yhOZjJpHHEWc+cTZqBthe4LVb1nXT+JJUvytti:b25HPHE/LqHheyVZXT+JJUvy

Score
10/10
rat6nrsformbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

6nrs

Decoy

mteverestminiralwater.com

northlakesodllcgov.com

de-guru.com

iwz-69.com

323va.com

tiktokshopbuilder.com

sekisensei.com

jcpublicschoolsfoundation.com

yangguangdadao.net

dingshenghr.net

yzyz458.xyz

topmczonseo.com

financeconta.com

handtools-88870.bond

scymedia.online

rutman.store

qlpss.com

righitch.com

parentsrpeople2.com

appeal-request-review.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3840-9-0x0000000003450000-0x0000000004450000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections