Overview

overview

10

Static

static

10

2828-13-0x...ry.exe

windows7-x64

1

2828-13-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2828-13-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    2662e7e8f71925ac054a4aeb63afa7b5

  • SHA1

    1db77f2961385d45deb45f573ac7bbfaa57429a0

  • SHA256

    2657c51f64966de6933b5284d3575eee18b493f6f48f096908243df695ce3260

  • SHA512

    55538881e0a969e853cc834dc8dcc6c8bbaf352940e5e185b1ef2d47b1c76923eb374a90ef8415a26b236c39eed3c2f892db4a378ce0a289868fffd286b6ec2f

  • SSDEEP

    3072:dgSsHkVi7vvnal3DmHnCo36AT0yJ6Tcq90rfmNpl0AstFssaCOjVa:OmiaJD8D6AT0yXqYQ0H

Score
10/10
ratcz30formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cz30

Decoy

6rka0.cyou

xbei.today

rajasakong88.com

huiwanzx.com

cfmcleaningservices.com

biztozz.com

ts8qxkb3j.sbs

kiwiest.com

junkfoodfilms.com

fan88t.net

satta-boss.com

rtpsensa15.fun

aeindesign.com

aqlu120.cyou

josiechow.com

fannieruth.com

smgct.com

tektotown.com

safelimouae.com

usesynch.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2828-13-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections