Overview

overview

10

Static

static

10

2c4792de76...cd.exe

windows7-x64

1

2c4792de76...cd.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2c4792de7621ec198b2918cf8c945b8386ea1d76136d6142837a257563403dcd

  • Size

    181KB

  • MD5

    495002ffb0bf17f125607e4c7015d335

  • SHA1

    dfd1f591d15cfe65636e9cfbb83fc916b9e4d563

  • SHA256

    2c4792de7621ec198b2918cf8c945b8386ea1d76136d6142837a257563403dcd

  • SHA512

    84fcaa7e659a11d7151294b22044cc47391a57012eb75a05832dbced74edf371484c502df2572c5af77aa328cd8dbef8f08b228c95681fbc5af55a72e26a1e44

  • SSDEEP

    3072:QWfqxEcElcY/7Bc3Uh5ztebFk2e7yM78f5LvPvn2X/dXLuFUF1kY/B0:pWExlSUrcbFk2e78xjP+XlX51kqB

Score
10/10
ratfs83formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fs83

Decoy

blastol.space

tomwalkerisfalco.com

us-sumatrraslimbellytonic.com

drywallandpaintingservice.com

vntapp.net

passportpages.site

at-mim.com

yeondagoods.com

teomanyildirim.com

paygame.site

senze.art

alhandco.com

9831bsej.xyz

traumatic.xyz

sos-soutien.com

thetechnolgy.live

washing-machine-46612.bond

marvsneakers.com

shequbaike.net

xc4f35fg4h35fg4h53.top

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2c4792de7621ec198b2918cf8c945b8386ea1d76136d6142837a257563403dcd
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections