Overview

overview

10

Static

static

10

209e29a293...4f.exe

windows7-x64

1

209e29a293...4f.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    209e29a293a0406927ea3c9f83bf62c79db3f9bd5b59868cc4a488ee06a6bb4f.exe

  • Size

    181KB

  • MD5

    9daa6738dfc0da0c7f62b468006e2c7a

  • SHA1

    4b706279b79883369f1dced3be35343c4a6d46da

  • SHA256

    209e29a293a0406927ea3c9f83bf62c79db3f9bd5b59868cc4a488ee06a6bb4f

  • SHA512

    cf85143e9925ab4269c4c9d29933bc5d257c519e05f6e6c623d6f53273b46008d777737d923faa6320d28a2e5224b0873d596a127562db821f3567a5d5cd78fe

  • SSDEEP

    3072:4WfqxEcElcY/7Bc3Uh5ztebFk2e7yM78K5LvPvn2X/dXLuFUF1kY/B0:RWExlSUrcbFk2e78IjP+XlX51kqB

Score
10/10
ratfs83formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fs83

Decoy

blastol.space

tomwalkerisfalco.com

us-sumatrraslimbellytonic.com

drywallandpaintingservice.com

vntapp.net

passportpages.site

at-mim.com

yeondagoods.com

teomanyildirim.com

paygame.site

senze.art

alhandco.com

9831bsej.xyz

traumatic.xyz

sos-soutien.com

thetechnolgy.live

washing-machine-46612.bond

marvsneakers.com

shequbaike.net

xc4f35fg4h35fg4h53.top

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 209e29a293a0406927ea3c9f83bf62c79db3f9bd5b59868cc4a488ee06a6bb4f.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections