formbook | 958d107ae823cd619fa042dcbaaa97155b1cecc092863f998f2ee4dca893beed[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
958d107ae823cd619fa042dcbaaa97155b1cecc092863f998f2ee4dca893beed.exe
Size 181KB
Sample240325-pp3byaae4w
SHA256 958d107ae823cd619fa042dcbaaa97155b1cecc092863f998f2ee4dca893beed
MD5 d12929cda63ca3f7fc4f0e4fc67a8635
SHA1 069971095c90d307343bacb403ca249dfb00c02b
SHA512 ccc36a624d53ceeb4cf3cf6bbdd4b3ce55393611712790e9226d75a70d9dfd7790eb10e1d718884aa850f76048d4f5b77f53223c935f22a5698bc8c517cbbcfd
SSDEEP 3072:aPlfxikQCGvR5XR3If1+WN6W5qLicYgq/V9lOK1OEHKTAVeZsKGOSUh:jCENIthN6W5qerXd9NOgKxqJOSi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat ns03 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

ns03

Decoy

dipity.tech
agathis.fun
ekaterinai.store
elizabethsbookshelf.com
smilesustainably.com
tapeworm.xyz
beatricesswarthout.xyz
nsrpackersandpackers.in
yedxec.xyz
gildedbeautyaesthitics.com
hanibalbechar.com
fichaphuman.net
adilosk.shop
geezaran.com
ventasemail.com
phonecasesdirect.store
rctjuc.shop
sukimossmanagement.com
caller-id.today
kft07.vip
mahbubamaahi.com
tcindustrie.net
ng-stl.com
vb4n53g4fh354gf5jh.top
repair-services.today
fonbnk.pro
olivabelle.com
pqeomjr.cc
elevatedblanks.net
ambiatec.solutions
quantumaster.online
pocket-option.tech
circly.net
focus2c.com
armacao-de-oculos.com
bmcj365.com
maxhealthunity.com
taifengtechnologyservice.com
zerolethal.com
dramaqu.guru
kukrejaassociates.in
jamesjenner.com
signature-perfect.com
fbaparadise.com
yandada.us
rcpbooks.site
celonstore.fun
dailynewarker.com
594545.xyz
chuanruhaomen.com
planetpost.lol
kinovod130424.pro
lavanced.com
leclandesparents.com
childnchestcare.com
taiyuanbaoyang.com
engagenotrage.com
halffullliving.com
scheuermannworks.com
oengpalworld.store
derech-hamagah.com
clintomator.com
velvetgloveseasonings.store
pkclubc.site
grupooceanique.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
958d107ae823cd619fa042dcbaaa97155b1cecc092863f998f2ee4dca893beed.exe

File Explorer

958d107ae823cd619fa042dcbaaa97155b1cecc092863f998f2ee4dca893beed.exe

.exe 181KB

958d107ae823cd619fa042dcbaaa97155b1cecc092863f998f2ee4dca893beed.exe

SHA256 958d107ae823cd619fa042dcbaaa97155b1cecc092863f998f2ee4dca893beed
MD5 d12929cda63ca3f7fc4f0e4fc67a8635
SHA1 069971095c90d307343bacb403ca249dfb00c02b
SHA512 ccc36a624d53ceeb4cf3cf6bbdd4b3ce55393611712790e9226d75a70d9dfd7790eb10e1d718884aa850f76048d4f5b77f53223c935f22a5698bc8c517cbbcfd
SSDEEP 3072:aPlfxikQCGvR5XR3If1+WN6W5qLicYgq/V9lOK1OEHKTAVeZsKGOSUh:jCENIthN6W5qerXd9NOgKxqJOSi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths