formbook | 1988-63-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

1988-63-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

34bc817d1ca06f61c4bff0f9c390b2c4
SHA1

42ce4457fdef92f65487eadfc1fbbb316936e1b9
SHA256

4c755a137a593abef5904bc2d64a4c44ee8814a709736c563adb75e0b576a640
SHA512

3d77092293d5aefe864c8f6a13641abf65b38aeaf3ba89fae359adb063f79bca1161a07526ed72e9b13c77eaf182b245593092964a458fd096fa7de75caa2a53
SSDEEP

3072:20Je3zkmJyKWqtud3cyeYtNFrKKbuNHPShiK7Pmvn5eJhowsvlEagID6:25HxARctYRrKKbuBPSIKjmxyJb

Score

10^/10

rat d06c formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d06c

Decoy

douglasdetoledopiza.com

yxcc.online

primo.llc

mediamomos.com

cosmetiq-pro.com

22labs.tech

turbowashing.com

lindaivell.site

princess-bed.club

groundget.cfd

agretaminiousa.com

lomoni.com

nessesse.us

lexgo.cloud

halilsener.xyz

kirokubo.cloud

corotip.sbs

meghq.net

5y6s.world

weasib.online

Signatures

Formbook family
formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook

resource	yara_rule
sample	formbook

Files

1988-63-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB