formbook | 780-71-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

780-71-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

5abf1f40ded763bc2af9a00fa700f12a
SHA1

f528d2cc8d3dc80aab57915c414dd3a4e0699c08
SHA256

46c34dc675ee2f43f75536d1fbfc952e9501089001a2b89a9a6aa40b668f9d29
SHA512

532eb4579e6aacf89a72c0b654e1d908f030299e0c5104eaf5136b82cb50281d3a0cc8197a0beb364a1a12880f7c18dc9e607f8e2b5a0d70feeaec18a93821a0
SSDEEP

3072:k7DMFQocvjBJ38o+/w7r6iwnoJE8TOuA2l0YbimaxrrDcO:QPT38X/I6iwnoJWNBY1adr

Score

10^/10

rat h3sc formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

h3sc

Decoy

seemessage.com

bitlab.website

cheesestuff.ru

bhartiyafitness.com

bardapps.com

l7a4.com

chiara-samatanga.com

lesrollintioup.com

dropwc.com

mackey242.com

rackksfresheggs.com

thinkvlog.com

aidmedicalassist.com

firehousepickleball.net

sifreyonetici.com

teka-mart.com

ddttzone.xyz

macfeeupdate.com

ivocastillo.com

serjayparks.com

Signatures

Formbook family
formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook

resource	yara_rule
sample	formbook

Files

780-71-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB