formbook | 2720-20-0x0000000000400000-0x000000000042F000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
2720-20-0x0000000000400000-0x000000000042F000-memory.dmp
Size 188KB
Sample240129-renf5sbdh8
SHA256 da2e48e2e655946112337e5086d994150db91955db8b3a1c89dfef70c3e7207f
MD5 41f8f661505118d31d93ead2c2851018
SHA1 24c3926cd4f1ecf19b6ff9e77de3571d2d1c18fe
SHA512 4ba74e5b221167342a8a0196f39117df7335598ced93bdd5ddaadbd3435839ed3bbc61daa9cd377a6c8fcb48d3b7cd80dae728975286f1328f38ee4058641a76
SSDEEP 3072:mMhW6uskTptEMCREB30JT0uaqPaHvNJBlKpGPMV1Ga4BjI0aInGSqdCDy:GLLh90h0zqPaHvH20MGlaTSEm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat df24 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

df24

Decoy

1ma5.site
mikej.engineer
aidelong8.com
kkrmarkets.com
ux-design-courses-76473.bond
careenfatfish.com
themediansib.com
sundialgaming.com
halckers.com
towingworcester.top
rrbxw.com
i2xy.site
8i11.site
ethanamartin.com
mobinfartak.com
kupontoto.homes
equisfinancialagency.com
cabe888-rfq.world
adniloc.online
osteoger.com
home-made-products.site
mubailvpai.com
magicaltripsandcruises.com
nenzhao.top
maldonadoportal.com
bs888.online
kcsf654.com
shufiya.com
autoseedinggroup.com
marllynx.com
polaireleg.store
uniposesrl.com
auzq.site
daddycouncil.com
mil393.vip
eatatjoesstoughton.com
lovehartlepool.com
lomatowing.top
sbmotorsiklet.com
sellingwestdesmoines.homes
reguleredettevanskelig.site
kirthivideos.com
grownewclients.com
onestopezshop.com
miaoyishop.com
naughtypleasuretools.shop
wholebuild.cfd
ohbabydesigns.com
populargrocery.net
influencercryptohub.com
pailleap.click
homewoodtowing.top
xiaoyalongsan2271.top
223man.com
lovxiy.xyz
sawyervillekeyword.top
astroreves.net
ledluumeo.com
clipper-hawke.com
gy3z0.xyz
monstertreeservicefl.com
anxiety-treatment-92389.bond
8xb783.com
ke86.net
hrsglobal.store

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2720-20-0x0000000000400000-0x000000000042F000-memory.dmp

File Explorer

2720-20-0x0000000000400000-0x000000000042F000-memory.dmp

.exe 188KB

2720-20-0x0000000000400000-0x000000000042F000-memory.dmp

SHA256 da2e48e2e655946112337e5086d994150db91955db8b3a1c89dfef70c3e7207f
MD5 41f8f661505118d31d93ead2c2851018
SHA1 24c3926cd4f1ecf19b6ff9e77de3571d2d1c18fe
SHA512 4ba74e5b221167342a8a0196f39117df7335598ced93bdd5ddaadbd3435839ed3bbc61daa9cd377a6c8fcb48d3b7cd80dae728975286f1328f38ee4058641a76
SSDEEP 3072:mMhW6uskTptEMCREB30JT0uaqPaHvNJBlKpGPMV1Ga4BjI0aInGSqdCDy:GLLh90h0zqPaHvH20MGlaTSEm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths