Overview

overview

10

Static

static

10

1580-70-0x...ry.exe

windows7-x64

1

1580-70-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1580-70-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    596f0e0213d9d209b0b3e074e50f3f23

  • SHA1

    5c2d60d78865319fe72940eb9f420bf794badaad

  • SHA256

    a6f2de0d9f631d29a1bbd66ebd37b965e4b6524642130f4a1d5ba9015d481e62

  • SHA512

    28112c347669d6d2bde8dc6e50c572c64bc85a5350f285201f0a4914b2020021778df7e04258d102ae534800b0e214f9f870bded17e37fc1f492822681723efc

  • SSDEEP

    3072:rgQh5FrIuKQHxrp6g4txp/3ic6dyeXO8tE5AFSQbJigINju:zkufx4tX/L6dye+8SAFg

Score
10/10
ratb48nformbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

b48n

Decoy

anifestmindset.net

ommybahamabigsales.shop

3tcxr.xyz

iano-world.net

rconf23.net

atherpa.shop

trllrpartners.club

5sawit777.pro

ctbhuxcdreioijresol.top

opinatlas.app

pinstar.xyz

mfengwa.top

8games13.xyz

tickpaket.online

iphuodongallbbtbtm.top

ental-bridges-51593.bond

laywithkemon.rest

lkpiou.xyz

a88.land

igfloppafan.club

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1580-70-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections