formbook | 1536-139-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

1536-139-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

8cbc6746355aa2fa689981338b9b7abf
SHA1

3743737f3b01b4384497e6e0f319441c683288e8
SHA256

9932e0e9f0c559bd30a0e9c7995da67100b59b31c4940dc857a43681c886415c
SHA512

55e3a0f12a4c128719490db958bec2f4076a2c7eb9803d53e56dfa0fb5354d40f88a7804d0b12762adc36204deb3fd2d7e17f7f30806c6abca7f7cc8f48f7b82
SSDEEP

3072:mueNWkFE3SqMayvyF03+gj+JL9afNaTKZJVcMM73AKlNDfMMf0:EM5yca+GYafgTKfcjlbMv

Score

10^/10

rat mn13 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mn13

Decoy

capecodwholesale.com

888888888888831.xyz

kasimov-gorodok.ru

jauquexgmail.com

charlottistraumtherme.com

efapst.top

tubero.africa

zoerestaurant.co.uk

digitalsmma.com

nebraskans.net

eve2020.com

0060000.com

4061manzanita.com

socialgalavenue.com

capeyorkdesign.com

ferdeutuhser.lol

bespokefragances.com

e-moods.com

iphiemarkethub.africa

tylerfostermanagement.uk

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Files

1536-139-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB