formbook | 1620-78-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

1620-78-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

6eba7a76ef3cd1d34728362b84adbd7c
SHA1

5145b3874b102d9cafe8bb425a33f30afd1b5878
SHA256

28dfd1e5bff9b3102be8f592f5a9ab5a2155a6a0119f02f2b4f1c2e286ef651f
SHA512

10d2af9d25007922cced22d2c6263902ae9292a624ceed137c41beb5b1f1df41a5ec10c064ac7108612880fc5254c32e91c2e149f10a11a7c33440a3f6718eb6
SSDEEP

3072:FPfEaXTppN4z33lawGLSvdTKd4q2NrNzeTyNA0pp2Fw:x+b34tLSVT9NpqIpp2

Score

10^/10

rat j13e formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

j13e

Decoy

qk003.com

freightfuture.co.uk

108palmerroad.com

thutienho.com

ardeoyourlife.com

bestcarszoo.com

cookingwithadele.com

anysoftware.cfd

digitalbiotech.agency

hospitalityskills.uk

fivestarsholidaylighting.com

cleandeals.net

tinysaints.online

moh-casino-fresh.club

fastlesbiandating.com

galvanizrulo.online

bbet678.com

voiceofdasouth.com

worldpetsexpo.com

parlementfleming.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Files

1620-78-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 181KB - Virtual size: 180KB

.text
Size: 181KB - Virtual size: 180KB