formbook | 904-67-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

904-67-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

3f0e1e3e3f2c409321bdb98805070b76
SHA1

e5eeb43d0cdb19df80fd78300a1e842fb5232176
SHA256

7fa2a8f51655291bc8e4d049227fa4d25aaf8e63c7f1843f08b8c4f24cd1a301
SHA512

d2b18bd78cd8d6e27a5b5bf977d6ba726d9337867b910317991ff577080116ce3d8e775f2788d06c72a7115471a0ad6b9841f081b9529216e5809aa8c0e7acfa
SSDEEP

3072:W0R6k536FdJgX3ur/XD8gq/GssSPrk5yOqjz1b:7VnubXDPq/GssSTksOk1

Score

10^/10

rat a4b0 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

a4b0

Decoy

style-searchers.com

daeundam.com

bxhdou.xyz

spb-masters-2001.site

starpakistani.com

krajulres.xyz

briansmess.com

napalme.com

tshirtleon.com

gxzjjx.com

createyourshine-aachen.com

satiliklabradorretriever.online

lionmillhomeinteriors.com

merakikarjat.com

body-pillow.life

medisolbd.com

koalayp.com

rodrigoalmeidamachado.com

thetropezian.com

onlyblondie.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Files

904-67-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB