Overview

overview

10

Static

static

10

2552-110-0...ry.exe

windows7-x64

1

2552-110-0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2552-110-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    b60f75530602d7deab3591e05edbe1dd

  • SHA1

    0aa46e81791e63292224cf8cce05a41d24383b4c

  • SHA256

    fae82df087b746da925a059ed983ee8a3cd6d17d08187a03cd33b00b407e96af

  • SHA512

    478729a886eac75de382d56bfc4bbafc1ecaed65f8605d4c45cccabaea0ba31e34062520b265fe7c9ac5240dcc085290ea0910e8e49dcc37467b6ed8dd86b0b5

  • SSDEEP

    3072:qNH7kKA75xgk83YwtIMfdG6TnE74eVcTj7D4I0DYV:fryYI7M6TnEEVv7EDYV

Score
10/10
rathe09formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he09

Decoy

clhear.com

maythunguyen.com

xiongmaoaijia.com

kembangzadsloh.xyz

speedwagner.com

360bedroom.com

campereurorg.top

cwxg2.site

mcdlibre.live

globigprimecompanylimited.com

1707102023-stripe.com

xhfj5.site

mugiwaranousopp.xyz

texmasco.com

sc9999.net

lite.team

8xb898.com

cibecuetowing.top

mgplatinemlak.xyz

southwestharborkeyword.top

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2552-110-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections