formbook | 4041c56677d1cb00888fd21ba80683f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
4041c56677d1cb00888fd21ba80683f0.exe
Size 185KB
Sample231030-gkrewabc5v
SHA256 2f4f94bfed428eddafff6e978a8042cd7519e4708ef6a3aaa6eb4b7f79e3c453
MD5 4041c56677d1cb00888fd21ba80683f0
SHA1 2527c1e306c2d0338580e709304180c69d7a4040
SHA512 dde29ede15c58a3c003e211e5ed4e5d1e54e77bf0fc14c3507e31b13644d907736806816876ee2aacb284c0f727f676e2a4a2afdfb0e81f616b91b09c4116d4d
SSDEEP 3072:MhiQaFrSCnW6KU7FQI01V+73eb1cfKTuOLmIWp/aIw2tcXb1o2mfWY:mVCn3BA1VU3e4KTuOLmMW4i2mf/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat 4hc5 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

4hc5

Decoy

amandaastburyillustration.com
7141999.com
showshoe.info
sagemarlin.com
lithuaniandreamtime.com
therenixgroupllc.com
avalialooks.shop
vurporn.com
lemmy.systems
2816goldfinch.com
pacersun.com
checktrace.com
loadtransfer.site
matsuri-jujutsukaisen.com
iontrapper.science
5108010.com
beidixi.com
21305599.com
peakvitality.fitness
osisfeelingfee.com
hotshark-shop.com
bollywood.nexus
stephenplattassociatesllp.com
bakepreneurs.com
claudiobarros.online
akabou-hayasaka.com
collibrishop.online
britishfemalevo.com
prestigesmp.online
wzmatics.com
sactribune.com
slotjitu88.website
theproactiveexpat.com
therealnikib.com
elnoh.life
tianyan110.com
tcbbuilds.com
zhe276.com
c1405.com
candicrem.com
lambdasigmarho.com
gemwhk.store
crissmendez.com
locduongseafood.com
jessformdsenate.info
329.bio
nbgonghe.com
tr-ij.com
quailrun-inc.com
pathlightpropertiesmgt.com
lpqxmz.site
castlegrouplt.com
beautybylily.com
bernabeicarniceriaygranja.com
spicax.com
globalentertainmentservices.com
modluxenwa.com
imaswe.com
hntv6201.top
homerevamps.today
motionmixmedia.com
antojitoslosramos.com
julieslive.com
bepnuclasechia.com
iqixuehe.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4041c56677d1cb00888fd21ba80683f0.exe

File Explorer

4041c56677d1cb00888fd21ba80683f0.exe

.exe 185KB

4041c56677d1cb00888fd21ba80683f0.exe

SHA256 2f4f94bfed428eddafff6e978a8042cd7519e4708ef6a3aaa6eb4b7f79e3c453
MD5 4041c56677d1cb00888fd21ba80683f0
SHA1 2527c1e306c2d0338580e709304180c69d7a4040
SHA512 dde29ede15c58a3c003e211e5ed4e5d1e54e77bf0fc14c3507e31b13644d907736806816876ee2aacb284c0f727f676e2a4a2afdfb0e81f616b91b09c4116d4d
SSDEEP 3072:MhiQaFrSCnW6KU7FQI01V+73eb1cfKTuOLmIWp/aIw2tcXb1o2mfWY:mVCn3BA1VU3e4KTuOLmMW4i2mf/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths