formbook | 1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1.exe
Size 184KB
Sample210917-k7ydgsfbb8
SHA256 561bedc1d6d589037ade015eb53f01c045fbd770982e04dc1b7a2acc677d67f4
MD5 b40cb0308a54ac1d3b997a74afa5d760
SHA1 d114b90c7838201624a3faf512d00c74095baa16
SHA512 e7e47000809d41cfcb9f82976fbf8972c1c3f6783f39a44234d6e4c519709e3bf82abddd072128630734d5297a0bca1471fb7a1377b9340b4e0b438c86b598a4
MD5 SHA1 SHA512

Score

10^/10

rat 3nop formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

C2

http://www.jakesplacebarbers.com/3nop/

Decoy

Signatures

Formbook Payload 1 IoCs

resource	yara_rule
sample	formbook

Formbook family
formbook

File Explorer

1.exe

.exe 184KB

1.exe

SHA256 561bedc1d6d589037ade015eb53f01c045fbd770982e04dc1b7a2acc677d67f4
MD5 b40cb0308a54ac1d3b997a74afa5d760
SHA1 d114b90c7838201624a3faf512d00c74095baa16
SHA512 e7e47000809d41cfcb9f82976fbf8972c1c3f6783f39a44234d6e4c519709e3bf82abddd072128630734d5297a0bca1471fb7a1377b9340b4e0b438c86b598a4
MD5 SHA1 SHA512

windows x86

Formbook Payload

rat