formbook | 876-75-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

876-75-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

44407084a1eedaa2276d761aa1354e84
SHA1

e4ed24f2519712d0a075a082b3fcf98e5b31da01
SHA256

76560c797fe504efdf5f6bdd2b7b3b2a6b531d1487422f2491b50bd6ceb55fdf
SHA512

2e167b01b8f85c04328dba14bff0bf85e72f770b67b4d6013e5a0ba25ad0b32573b2f92c7333f77f38b725202a0c2a8e7d459cda580b451256a3523ab0577247
SSDEEP

3072:+ls2kzV4krLBv73+buRH4KH2mI0rZ2zNFTFZGmdnFe5CBqMEA1:VZ5T+y54KH2mIIuFxZt1cjs1

Score

10^/10

rat pr28 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pr28

Decoy

huaxinimg.com

baorungas.com

comercializadoramultimus.com

blr-batipro.com

wantagedfas.uk

1thingplan.one

cweilin.com

lorienconsultingllc.com

jdzsjwx.com

casafacil.site

hkacgt.com

hasid.africa

92dgr97k4hr9.com

cvbiop.xyz

1wbskm.top

fantasticmobility.com

goodchoice2022.com

hafizpower.com

familiajoya.com

fundscrahelp.info

Signatures

Formbook family
formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook

resource	yara_rule
sample	formbook

Files

876-75-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB