Overview

overview

10

Static

static

10

ea47f8f870...94.exe

windows7-x64

1

ea47f8f870...94.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    ea47f8f8708cab1686ba0c2d9bb45c4dac3b11a296dfca06056d05df0d744d94.exe
  • Size 181KB
  • Sample230206-h2n7hsce49
  • SHA256 ea47f8f8708cab1686ba0c2d9bb45c4dac3b11a296dfca06056d05df0d744d94
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ratfh11formbook

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • fh11

Decoy

  • dejeucrew.com

  • naijacash.africa

  • hhnego.cfd

  • freeentitys.com

  • acestrix.com

  • family-doctor-38536.com

  • kelleyhomegroup.com

  • ridamedicalsupply.com

  • ease.dev

  • moneyerase.com

  • ax-assess.com

  • dexzec.com

  • lazada.cool

  • themontery.africa

  • 4help4all.com

  • fxfreedom.vip

  • twitterabout.com

  • kensingtonbuisserv.co.uk

  • 488677.vip

  • akfomtechnology.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat

File Explorer

  • ea47f8f8708cab1686ba0c2d9bb45c4dac3b11a296dfca06056d05df0d744d94.exe
    .exe 181KB

ea47f8f8708cab1686ba0c2d9bb45c4dac3b11a296dfca06056d05df0d744d94.exe

  • SHA256 ea47f8f8708cab1686ba0c2d9bb45c4dac3b11a296dfca06056d05df0d744d94
  • MD5 SHA1 SHA512 SSDEEP
windowsx86

  • Formbook payload

    rat
Minor OS version
Major OS version
Entry point
127360
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths