formbook | 4588-167-0x0000000010410000-0x000000001043E000-memory[.]dmp

General

Target

4588-167-0x0000000010410000-0x000000001043E000-memory.dmp
Size

184KB
MD5

52daa3b8d7a00c033c99c6d500472eb3
SHA1

9fd0eccc203d437405bab2296c24a4071c0bf723
SHA256

1729897277ebd5215234eff086fa731a8d92eb424dcd058fdb41faec1daad9cc
SHA512

cc69c112e21200f016e0f9d699cea3e9165ae427c4b1bc08592933608e386c6be2f8104985c8a85f1ae3552c29409fe700f3d1c4a8f053f27a0d29b1d6cd2e0d
SSDEEP

3072:0z/R8gbLs7zkfXXQzJbeX/lqyKaUM0672SlZq04oF3f/sRlRShY4NR3t:ClEKXQxeMraUM32H/oNf/sfwY4NR3t

Score

10^/10

rat n7ak formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n7ak

Decoy

modischoolcbse.com

theneverwinter.com

rszkjx-vps-hosting.website

fnihil.com

1pbet.com

nnowzscorrez.com

uaotgvjl.icu

starmapsqatar.com

ekisilani.com

extradeepsheets.com

jam-nins.com

buranly.com

orixentertainment.com

rawtech.energy

myol.guru

utex.club

jiapie.com

wowig.store

wweidlyyl.com

systaskautomation.com

Signatures

Formbook Payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook
Formbook family
formbook

resource	yara_rule
sample	formbook

Files

4588-167-0x0000000010410000-0x000000001043E000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 177KB - Virtual size: 177KB

.text
Size: 177KB - Virtual size: 177KB