formbook | 1484-64-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

1484-64-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

61870994e6c788ca3d3a84ee82a820e4
SHA1

3323be34c8620ca97d385d37d2fbdb481fb7d252
SHA256

e19af05eea974aee0be74f416413835c78d8dce57987ef403d6e3eaca01a40a8
SHA512

0aa778d5429c1dd3e35d4672c3ab9e8d64ce85f31545d16f09bd032263527c0372c0f5eac2a2b254b3dd96e3f5f8d2636d27195f9b960124312065306974fea4
SSDEEP

3072:EkawgkmBuqUEpo3kqQ1ntywCjKLB8VZUeNuG55PzqHOFjy35y3QwW/d:7sDmkX1n8TKLB8QzGPzqyj93C/d

Score

10^/10

rat tc10 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

tc10

Decoy

mwigyu.com

sepuluholx.com

nsdigitalagency.com

horrorkore.com

santaclaracoimbrakarate.com

myeternalsummer.com

laosmidnight-lotto.com

haremp.xyz

boyace.top

unusualwithdrawal.com

wildflowerkidsri.com

backlitvps.dev

topwellgas.com

k3nnsworld3.com

wanbang.xyz

cntvc.net

sjcamden.church

pussit24.com

claml.com

statisticsturkey.com

Signatures

Formbook family
formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook

resource	yara_rule
sample	formbook

Files

1484-64-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB