formbook | e3c50af5dfca67fd9af9530c801ef172bde856241cf6b2c8596421b9a7ae8882[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
e3c50af5dfca67fd9af9530c801ef172bde856241cf6b2c8596421b9a7ae8882.exe
Size 181KB
Sample240403-p7hp9add5v
SHA256 e3c50af5dfca67fd9af9530c801ef172bde856241cf6b2c8596421b9a7ae8882
MD5 850af81f5e42226df54a965cd8d2e0bd
SHA1 08a603cb2fdb4724b8f72e53f01f9f3a20d51cea
SHA512 462d9642084f7817e0f34b384444d828e5233a74d5acbe0a2e80752708623220bb60474c9efff17cf5fffc79e904bc7f3e3787ddf603a7f952ac14ec00f246d8
SSDEEP 3072:exEUkOmDbSNE3OIF1KLaA6i/hslrQ7Rj4+aYS7JSWoE:CfqO81KaA6ipqaXh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat kh11 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

kh11

Decoy

theluckypaddle.net
assurelinkenterprises.com
gazpachogroup.com
worxservicesllc.com
bestecankurban.com
cotebrief.com
899173.com
navist.io
metaverseharem.com
genpower-plus.com
drhandgrip.com
jessicachristina.com
eidura.com
cat2000andhope1izfanfiction.com
nywaiverlatam.com
cdlb9twt.shop
j2mjewerly.com
itsmisshodges.com
timeis.shop
santefe4g.com
ongame.cloud
guard-dd.online
rutgersorthopedics.com
rkbengg.com
dentalemergencybakersfield.com
jansirani.com
gadilglobal.com
unitygiftingco.store
enxk-32.com
northcuttmediacompany.com
hyyhldz.site
stripperscontest.com
lexcomtech.com
issndiploma.com
shopynuts.site
shpoifypos.app
gamer24.top
dibujosparapintar.net
healthinsuranceudeserve.com
pampadev.tech
whefgf.club
riversandcapital.com
foroupskirt.com
wocan92.top
onehourbookclub.com
brochuresenligne.site
suv-deals-85472.bond
coalswap.com
tresxop.xyz
juniortrevisol.com
it-jobs-87776.bond
black-loan3.shop
chicprems.xyz
pmheiouassessment.shop
186489.support
88mahadewa.vip
vn90129.me
cattaillake.com
jmknoh1r.shop
attitudedancefitness.com
eventcrrate.com
autonomoangola.com
jollshopp.com
thesimplestudio.io
gltip2le.shop

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e3c50af5dfca67fd9af9530c801ef172bde856241cf6b2c8596421b9a7ae8882.exe

File Explorer

e3c50af5dfca67fd9af9530c801ef172bde856241cf6b2c8596421b9a7ae8882.exe

.exe 181KB

e3c50af5dfca67fd9af9530c801ef172bde856241cf6b2c8596421b9a7ae8882.exe

SHA256 e3c50af5dfca67fd9af9530c801ef172bde856241cf6b2c8596421b9a7ae8882
MD5 850af81f5e42226df54a965cd8d2e0bd
SHA1 08a603cb2fdb4724b8f72e53f01f9f3a20d51cea
SHA512 462d9642084f7817e0f34b384444d828e5233a74d5acbe0a2e80752708623220bb60474c9efff17cf5fffc79e904bc7f3e3787ddf603a7f952ac14ec00f246d8
SSDEEP 3072:exEUkOmDbSNE3OIF1KLaA6i/hslrQ7Rj4+aYS7JSWoE:CfqO81KaA6ipqaXh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths