Overview

overview

10

Static

static

10

2040-63-0x...ry.exe

windows7_x64

1

2040-63-0x...ry.exe

windows10-2004_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    2040-63-0x0000000000400000-0x000000000042F000-memory.dmp
  • Size 188KB
  • Sample220627-qqd66sbdcj
  • SHA256 664b0f30a8715d05ce6428fa8a4121a3c9259783705e6841e61eb0c2d48d4bc3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ratir93formbook

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ir93

Decoy

  • dostavka47.store

  • mangguoav.xyz

  • yourhealthstore.life

  • sharpecartoons.com

  • webbankrate.com

  • sublimephotography.online

  • crudepurple.xyz

  • basselibrahim.group

  • peroalkeys.com

  • vntiktokshop.xyz

  • lasarview.com

  • notherdaylope.site

  • hengqijc.com

  • thejamstar.com

  • adityapeen.com

  • bestseeds-21.xyz

  • qaaronautoinsurance.xyz

  • eadservices.online

  • hubei23.com

  • lanenucacontenedor.com

Signatures

  • Formbook Payload 1 IoCs
    rat
  • Formbook family
    formbook

File Explorer

  • 2040-63-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe 188KB

2040-63-0x0000000000400000-0x000000000042F000-memory.dmp

  • SHA256 664b0f30a8715d05ce6428fa8a4121a3c9259783705e6841e61eb0c2d48d4bc3
  • MD5 SHA1 SHA512 SSDEEP
windowsx86

  • Formbook Payload

    rat
Minor OS version
Major OS version
Entry point
127296
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths