formbook | ad896a8982941cd8a7b4f237f775e712dc1a05cfb2d80601d45f4cc73475ecc0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ad896a8982941cd8a7b4f237f775e712dc1a05cfb2d80601d45f4cc73475ecc0.exe
Size 181KB
Sample240325-pp3mpsae4x
SHA256 ad896a8982941cd8a7b4f237f775e712dc1a05cfb2d80601d45f4cc73475ecc0
MD5 ca212d9f062a189528f1204eca8cce94
SHA1 f3bf213d6ba75390025f6534a539532fcccf4696
SHA512 49722de9ae3c105bf1bfec52b3983af74c721f37d9745717a6704c9bac5ae4b65714ba34273ae2b21d917691d605fff1600c21c62fbab75384504d3ff16b02df
SSDEEP 3072:PPlfxikQCGvR5XR3If1+WN6W5qLiHYgq/V9lOK1OEHKTAVeZsKGOSUh:0CENIthN6W5qe4Xd9NOgKxqJOSi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat ns03 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

ns03

Decoy

dipity.tech
agathis.fun
ekaterinai.store
elizabethsbookshelf.com
smilesustainably.com
tapeworm.xyz
beatricesswarthout.xyz
nsrpackersandpackers.in
yedxec.xyz
gildedbeautyaesthitics.com
hanibalbechar.com
fichaphuman.net
adilosk.shop
geezaran.com
ventasemail.com
phonecasesdirect.store
rctjuc.shop
sukimossmanagement.com
caller-id.today
kft07.vip
mahbubamaahi.com
tcindustrie.net
ng-stl.com
vb4n53g4fh354gf5jh.top
repair-services.today
fonbnk.pro
olivabelle.com
pqeomjr.cc
elevatedblanks.net
ambiatec.solutions
quantumaster.online
pocket-option.tech
circly.net
focus2c.com
armacao-de-oculos.com
bmcj365.com
maxhealthunity.com
taifengtechnologyservice.com
zerolethal.com
dramaqu.guru
kukrejaassociates.in
jamesjenner.com
signature-perfect.com
fbaparadise.com
yandada.us
rcpbooks.site
celonstore.fun
dailynewarker.com
594545.xyz
chuanruhaomen.com
planetpost.lol
kinovod130424.pro
lavanced.com
leclandesparents.com
childnchestcare.com
taiyuanbaoyang.com
engagenotrage.com
halffullliving.com
scheuermannworks.com
oengpalworld.store
derech-hamagah.com
clintomator.com
velvetgloveseasonings.store
pkclubc.site
grupooceanique.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad896a8982941cd8a7b4f237f775e712dc1a05cfb2d80601d45f4cc73475ecc0.exe

File Explorer

ad896a8982941cd8a7b4f237f775e712dc1a05cfb2d80601d45f4cc73475ecc0.exe

.exe 181KB

ad896a8982941cd8a7b4f237f775e712dc1a05cfb2d80601d45f4cc73475ecc0.exe

SHA256 ad896a8982941cd8a7b4f237f775e712dc1a05cfb2d80601d45f4cc73475ecc0
MD5 ca212d9f062a189528f1204eca8cce94
SHA1 f3bf213d6ba75390025f6534a539532fcccf4696
SHA512 49722de9ae3c105bf1bfec52b3983af74c721f37d9745717a6704c9bac5ae4b65714ba34273ae2b21d917691d605fff1600c21c62fbab75384504d3ff16b02df
SSDEEP 3072:PPlfxikQCGvR5XR3If1+WN6W5qLiHYgq/V9lOK1OEHKTAVeZsKGOSUh:0CENIthN6W5qe4Xd9NOgKxqJOSi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths