formbook | 1492-59-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

1492-59-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

3e42fb22b7ec74356e80c3f4a3f33122
SHA1

5292d054904b7b7e57a0b63f5ff1d562a92eb990
SHA256

a0a65129c7e9e35be48a4edacfbaeb6585f5126bc777f88bb7d66880e056bed3
SHA512

c4ec89ed640d0de0b0d4ffa845f71bd6a8a7e68e85ea777d6c153dac105327ac5fe975af435406511d67823b6f48082b0e195fa085de04cac69b73f119ac1d35
SSDEEP

3072:7j0vanEBPrMIZbeXZ4cYJ8664WvMn2wj0kc8nZ8G6D+C0XXw:7GXboD664WG2VnIID+bXw

Score

10^/10

rat d27e formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d27e

Decoy

yourfitplan.online

the-arches.wales

shesashemale.com

genesisairsystemsltd.com

superpanoramas.com

kaixinzx.com

blockchainfacil.com

migstrip.online

fightfentanyl.net

triviabritannica.site

eineetnocni.xyz

danibrito.com

ghostmacro.com

livechat-online.site

adriftontonka.com

iloveuae.mobi

miaescorts.com

taxrulings.com

aobo123.top

nostosmma.com

Signatures

Formbook family
formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook

resource	yara_rule
sample	formbook

Files

1492-59-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB