formbook | 1132-139-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

1132-139-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

1fe9ff700f4b5cf022b679f3997a3821
SHA1

ab40ba35e92ab8f2f2c218b4cf6730596ff22d20
SHA256

ca2c6c2ec41a57262e5509c835ed788dcfc71f98eabfac738bcac7d1294537ca
SHA512

99f03a023ff5ddba79e7e96b075ed8215cc7e44016ff9b3cd8810541eecedeba4bb97526a17bc1204d151999cab076f084ce42cc778ba008089b15ccde24304b
SSDEEP

3072:EkawgkmBuqUEpo3kqQ1ntywCjKLB8VZUexuG55PzqHOFjy35y3QwW/d:7sDmkX1n8TKLB8QrGPzqyj93C/d

Score

10^/10

rat tc10 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

tc10

Decoy

mwigyu.com

sepuluholx.com

nsdigitalagency.com

horrorkore.com

santaclaracoimbrakarate.com

myeternalsummer.com

laosmidnight-lotto.com

haremp.xyz

boyace.top

unusualwithdrawal.com

wildflowerkidsri.com

backlitvps.dev

topwellgas.com

k3nnsworld3.com

wanbang.xyz

cntvc.net

sjcamden.church

pussit24.com

claml.com

statisticsturkey.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Files

1132-139-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB