formbook | 856-63-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

856-63-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

e7c53baac3a97a99e2a363e7f9401cc9
SHA1

a2f204fd3397dda4b9b1b777bd15395c87fa8fc4
SHA256

e26b2399e6ed2f2b40cef9e16bbbc3c10c94e238d14a09528423104dbbc38e1e
SHA512

aac7008f8c5c438a4a61f0c7269b3917bddd784560cce471ebf73ec395252c0395371c2a2f05631f160a478e5d8a9b080c4e455e4e7ba2dc4b0e9d5605c3eb33
SSDEEP

3072:eAUEj2hvXGj33Maqb70hqjLaf6/fFfSL440ekQLbm2:qEHMVn2qjLaf6/f6V0ekWbm2

Score

10^/10

rat ua69 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ua69

Decoy

uslanmayizz.com

rrucrowd.com

nerexy.online

guolang-clan.com

meteleabogados.com

sh-gottipati.com

themesmiui.com

anananlan.com

roghanala.com

yekitiba.com

echoskinco.com

btlpour.xyz

shoyo-samaa.com

fuzzywumpus.net

malerzeit.com

xiam.online

brandibraunalissa.com

cryptominis.pro

we-living.com

dc-invest.online

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Files

856-63-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB