formbook | 1316-85-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

1316-85-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

4b640f5fa2ba22b34ab7c130ae983985
SHA1

ce2c81e61a344cbfff7d93ddd57f9d32dd9f531f
SHA256

8d3f8777ecbfc84c9e14cc224f98235fb139fae3403df0bb463526e459f4f020
SHA512

223c73f4c6f20b0a421ef0e9e88a83575ffdb01aff0ae31c574feec0442bcab381b00889c901e8ae5c464012989a08ac14351e0056c6e06c9dd49061cb618ea7
SSDEEP

3072:E4rZE8LkKRqZWwRt6ueMrWtlyJuebEcT8DhWPi//MWvx:EmHAt9FrWtlPewcT8DsPiHMWp

Score

10^/10

rat t19g formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

t19g

Decoy

playstationspiele.com

cakesbyannal.com

racepin.space

anti-offender.com

magnetque.com

farragorealtybrokerage.com

khuludmohammed.com

v33696.com

84ggg.com

d440.com

soccersmarthome.com

ofthis.world

fivestaryardcards.com

lusyard.com

gghft.com

viajesfortur.com

rationalirrationality.com

hanaramenrestaurant.com

exactlycleanse.com

martensenargentina.com

Signatures

Formbook Payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook
Formbook family
formbook

resource	yara_rule
sample	formbook

Files

1316-85-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 181KB - Virtual size: 180KB

.text
Size: 181KB - Virtual size: 180KB