formbook | 1516-84-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

1516-84-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

75c37e5cfebc2322fe97cc0dc28e848a
SHA1

221972fb2dce8ab3ced6d84e6e280427e6285bfd
SHA256

8758fbee60d4519b40c26d7ff4da80ba63932660e5ca76b51680418813b3f893
SHA512

1f0fa0a613689667f0716b1e2fb38a0cfed8a161e143a61d8e0ed0eb52d37b31d7f1221845a30af8c62873f675320dd9865aa1049ddd52e30939ef9beafea20f
SSDEEP

3072:9EdDDirkRm8jDuGY3WeAyfybU4ap1Hs4d/hcpvLccfISbk/k1yxEK/dTX:gwGWW3yfyQ4aHHs4NhBc7Po2+

Score

10^/10

rat sa79 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sa79

Decoy

aidigify.com

angelavamundson.xyz

glicotoday.fun

agencyforbuyers.com

blacklifecoachquiz.com

4e6aqw.site

huawei1990.com

diyetcay.online

chesirechefs.co.uk

generalhospitaleu.africa

hfewha.xyz

lemons2cents.com

rahilprakash.com

kave.tech

netlexfrance.net

youthexsa.africa

car-covers-40809.com

bambooactive.store

fotobugil48.com

kuhler.club

Signatures

Formbook family
formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook

resource	yara_rule
sample	formbook

Files

1516-84-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB