Overview

overview

10

Static

static

10

3140-9-0x0...ry.exe

windows7-x64

1

3140-9-0x0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    3140-9-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    cbc84f69606bb3170ae8ac3dfd25f9c1

  • SHA1

    3f6dda08afe4f756f5573afdf9c099b026a0f039

  • SHA256

    7d73e5bb30fda6a67b42806b908f156d5be42cebe57977a42cbb2a588e5f61a2

  • SHA512

    5d9186eadfd37665e7000feef16d349e8007671074b6cb7848d8c8eaf06d8c70c442608707fb2b0e963c2b7bbcd17ba40a6e643bd3423752f476a6abd8aaa8bb

  • SSDEEP

    3072:BCq7EHTtsE4xh3e21rNR6aZtTIe2o5lBpgcr8iNlIPM:mudeWrNzZtTIe2Ol0cYAlIP

Score
10/10
ratcs82formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cs82

Decoy

rolova.app

osramhidchina.com

kancelariaderewicz.com

lexysalvago.com

spillingink.xyz

gx128.xyz

2tgxb.com

digitalbirch.com

12yue-83.xyz

mil916.vip

jaulcappearcount.store

8xb466.com

gdscsrcasw.club

cleaning-services-86033.bond

meshwebdesign.com

ajphotographsatx.com

rrav11.store

buzzferd.com

kneegenix.com

rentalriverside.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3140-9-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections