formbook | 1864-75-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

1864-75-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

42b4767fa58337b116f334d52d8dab4b
SHA1

b1623d645b931c33821f9c9276302087a5814b1b
SHA256

c654fa72f42b999a903342835dac93dcd108118c9c3bddf8c7e270ebe39224df
SHA512

cf24392bd6d822c7e816285a2430b12ffd48ec7f6c5834c11086bdae8f4c53ceae8d8ec5745c627863731aa6f1e83e7b51331af5e75fd1fe4ea39cc5dfa18e3c
SSDEEP

3072:815ZX0Mk9PMj0ri3R+K6ShnaGbWK2PCAUd7Tvctz2HRTLc2UaP3KofZ:8ODtUR16GnaAWK2PGdvvcNURTB33Koh

Score

10^/10

rat fw02 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fw02

Decoy

payer-breakers.com

thesiscoper.com

rental-villa.com

scovikinnovations.com

hydh33.com

allmyshit.rest

lovejaclyn.com

vanessaruizwriting.com

dufonddelaclasse.com

kiddee168.com

monumentalmarketsllc.com

musclegainfatloss.com

avida.info

cosmo-wellness.net

dandelionfusedigital.com

oversizeloadbanners.com

konstelle.store

sdjnsbd.com

czoqg.xyz

5p6xljjse1lq.xyz

Signatures

Formbook Payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook
Formbook family
formbook

resource	yara_rule
sample	formbook

Files

1864-75-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB