formbook | 4256-190-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

4256-190-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

5db1df60e37e1691f629e33671d87e6a
SHA1

5f76f8606d2c7b10f92d7faf026712bc2daf619d
SHA256

7679319973024e77536316a172eac0b37e1c01271d9797016606bfe44621adbb
SHA512

d9b37d207bf32ae98559201182457e9ac311667842a92901f9cf84a19973e4925a7f213fee4d53d2cd7b1a2b100c4db08959aa69d3b2be2f7466c258a5d56aa3
SSDEEP

3072:rgdEp4XF1YqJ30EYrHnG9vna0+MmsI7hnnpKIEtJ6iFpLCsbOAuV:lQ10xrHG9fa0+MmL7hnsIxifpS

Score

10^/10

rat je73 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je73

Decoy

socialorientation.com

thehoneybeeagency.info

cloudphp.net

nftprofile.xyz

washtenawac.com

perfhealthco.com

shareadvertising.net

emeetic.com

px8.store

lkjhhk.live

colsonlandscapes.com

isabellassecret.com

anosay.com

pipsbullsmarket.com

thingsl.com

green-island-farm.store

aromaoil-zero.com

ukrainiantours.vip

qualitykleaning.com

berlinskymusicrecords.online

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Files

4256-190-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB