Overview

overview

10

Static

static

10

2024-64-0x...ry.exe

windows7-x64

1

2024-64-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-64-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    4fa795eedb52b516b0467155c60d648e

  • SHA1

    3b73fc60bc7ae9f05db83b19786e66b4984fa06b

  • SHA256

    643e76c5f508a92f6283c4b049e2ccbf2540dc5d654ef339008d9e0ec35b1f88

  • SHA512

    e07bc25dce5ef6613b1d0fb3ae31feace40a98a4ac449cf8fc4b2314a65d21b6ef3f0592d8509665bed88c73d47453e50c8cee92171504c4fd0cb338e5954653

  • SSDEEP

    3072:Ysifk6h7+xC5V3D30ADm5bXKn4F3VHHpp8YjvWgWeBlKlmcuVi8bBEth1W:4j5D31m5LKn4FVHbXqpkni9trW

Score
10/10
ratcg62formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cg62

Decoy

autopilotjulia.com

ojaymart.africa

fondatorireverie.com

cl-apple.online

24hr4x4towing.com

elkooshop.com

createaconference.com

pricesales.co.uk

aquaconsoil2023.com

juankteayuda.com

julievod.com

edelman-production.com

aaataxassistants.com

itmcnews.africa

efefamount.buzz

americanhorseauctions.com

conradrawford.click

bestofgiving.com

centralniccorportate.co.uk

diadien.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-64-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections