formbook | 52d8942e61bd4086fcff78395b40844a7cf525ce5e1201544451e8cd2113e8d8[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
52d8942e61bd4086fcff78395b40844a7cf525ce5e1201544451e8cd2113e8d8.exe
Size 181KB
Sample240227-nvkteagc8s
SHA256 52d8942e61bd4086fcff78395b40844a7cf525ce5e1201544451e8cd2113e8d8
MD5 3a39a7b7684baebe8b5fc5f1f16ff09b
SHA1 4aac2d8d96c2a952adad7074bdef654d76439e97
SHA512 0d6be9719afc36687c7e9224eccc937ec500dc92c4df6a4b37c88dde5e41791c772f846534c6317c3f1c76c21adf0408a30c9bc3d5f799aa19f96e3a2be90d98
SSDEEP 3072:fMuck0YCUzDPZ2JezlZP56s8O2CZF7kl6z2p8zA8wxQkxIz+jk:E+QUr56s8O2kO6zEzQkxrj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat cz30 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

cz30

Decoy

valeriepuma.com
rentyourbag.com
unglesbyessure.com
ahzmjy.site
taazdelights.online
conexoesnews.com
istprimeway.com
elwf4tlu.shop
661.support
fournaisehk.com
glechiu.xyz
2r2pv2.shop
902523.rip
bruggicapy.com
westmobileautodeatailers.online
muaad.co
gridxsens.com
victoronedesigns.com
tecexpressbr.com
crea4net.com
ibtamarketing.com
slot-777.bet
directoriokansascity.com
izmirdeumitvar.com
gkw92121aej.com
ariseclo.com
amyandkellywedding.com
acuservsolutions.co
autaxmygov.life
ekbredyc.top
80121.club
alicejoppa.com
fitnatil.shop
414545.top
exirdaru.com
aiprofitslive.com
boatnirvanalife.com
wolfieknorway.com
paperwork-jakarta.com
uae535.com
ardunino.com
ovisuregoldthai.xyz
graceandgratitude.shop
zz35782.com
ozuguler.com
determinado-procon.site
s22jlurtjw.biz
edmotus.com
poolhousesupply.com
mineralsandminingme.com
maxgamingwoods.com
genclerkonagi.com
sanjaycabs.com
kyzerfilms.com
miujamconstruction.com
urbanecom.in
doraldentalstudiobook.com
klasku.store
drgderigo.com
zipang.xyz
artbyvisn.com
worldofperfumes.us
ntxd.life
teeleads.com
angpaogenit77.store

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52d8942e61bd4086fcff78395b40844a7cf525ce5e1201544451e8cd2113e8d8.exe

File Explorer

52d8942e61bd4086fcff78395b40844a7cf525ce5e1201544451e8cd2113e8d8.exe

.exe 181KB

52d8942e61bd4086fcff78395b40844a7cf525ce5e1201544451e8cd2113e8d8.exe

SHA256 52d8942e61bd4086fcff78395b40844a7cf525ce5e1201544451e8cd2113e8d8
MD5 3a39a7b7684baebe8b5fc5f1f16ff09b
SHA1 4aac2d8d96c2a952adad7074bdef654d76439e97
SHA512 0d6be9719afc36687c7e9224eccc937ec500dc92c4df6a4b37c88dde5e41791c772f846534c6317c3f1c76c21adf0408a30c9bc3d5f799aa19f96e3a2be90d98
SSDEEP 3072:fMuck0YCUzDPZ2JezlZP56s8O2CZF7kl6z2p8zA8wxQkxIz+jk:E+QUr56s8O2kO6zEzQkxrj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths