Overview

overview

10

Static

static

10

2528-11-0x...ry.exe

windows7-x64

1

2528-11-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2528-11-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    7fad72aba0c03e24573515290abf828b

  • SHA1

    0a309f958f94a5bd0534e56c7577cfdecf62c727

  • SHA256

    61b17fc8011ac422d7737a297b5036ba3ff18e3dc4fffd06195d957a0f69ee38

  • SHA512

    2f168f3edebb77aa329fb06f158bca390b411561364a317852aea931dcb44fd97e04c59093e4ad69c3d250c7ac0078ac9e6e2c81fb60d93f43828f7991ac87be

  • SSDEEP

    3072:5brEFsMkES8nnM3dOELG06gp06trqk8ywJhov5iRU:22snejLG06V61qk8ykho8R

Score
10/10
ratfd05formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fd05

Decoy

rancangrumah.com

liposuction-54947.bond

9smp.studio

tranquilos.club

slknb9x4.shop

huidvh.xyz

59638.bet

611422.cc

gurdwarakaramsar.com

level42data.com

remedydx.com

aagmal.pro

aicertifiedpro.com

reeoumcuoarriron.shop

syrianphotographers.com

findasideproject.com

frontierconnects.co

cliphothomnay.top

vbywehjri3.top

hydrogenwaterbottles.co

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2528-11-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections