formbook | 66c25b056feae73374a9cb4db0469c94d0a1d2d91cfe09cad1e890e72d5bfb70[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
66c25b056feae73374a9cb4db0469c94d0a1d2d91cfe09cad1e890e72d5bfb70.exe
Size 181KB
Sample240404-cbemhabe2s
SHA256 66c25b056feae73374a9cb4db0469c94d0a1d2d91cfe09cad1e890e72d5bfb70
MD5 9b8994e3996f1ff8b74de9098fcc0b17
SHA1 214ef15343ba733a307f2e13512d57b124e9a07d
SHA512 fe40d58d03f9821f146154bf4f9bde780ec896e2677e9eeb990d83aac2e181c0be717e544bf2a7c6b16dcd6c0b4e29d982c96e89b655063d46dbceb6d7e1ccac
SSDEEP 3072:3PlfxikQCGvR5XR3If1+WN6W5qLi0Ygq/V9lOK1OEHKTAVeZsKGOSUh:8CENIthN6W5qeDXd9NOgKxqJOSi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat ns03 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

ns03

Decoy

dipity.tech
agathis.fun
ekaterinai.store
elizabethsbookshelf.com
smilesustainably.com
tapeworm.xyz
beatricesswarthout.xyz
nsrpackersandpackers.in
yedxec.xyz
gildedbeautyaesthitics.com
hanibalbechar.com
fichaphuman.net
adilosk.shop
geezaran.com
ventasemail.com
phonecasesdirect.store
rctjuc.shop
sukimossmanagement.com
caller-id.today
kft07.vip
mahbubamaahi.com
tcindustrie.net
ng-stl.com
vb4n53g4fh354gf5jh.top
repair-services.today
fonbnk.pro
olivabelle.com
pqeomjr.cc
elevatedblanks.net
ambiatec.solutions
quantumaster.online
pocket-option.tech
circly.net
focus2c.com
armacao-de-oculos.com
bmcj365.com
maxhealthunity.com
taifengtechnologyservice.com
zerolethal.com
dramaqu.guru
kukrejaassociates.in
jamesjenner.com
signature-perfect.com
fbaparadise.com
yandada.us
rcpbooks.site
celonstore.fun
dailynewarker.com
594545.xyz
chuanruhaomen.com
planetpost.lol
kinovod130424.pro
lavanced.com
leclandesparents.com
childnchestcare.com
taiyuanbaoyang.com
engagenotrage.com
halffullliving.com
scheuermannworks.com
oengpalworld.store
derech-hamagah.com
clintomator.com
velvetgloveseasonings.store
pkclubc.site
grupooceanique.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
66c25b056feae73374a9cb4db0469c94d0a1d2d91cfe09cad1e890e72d5bfb70.exe

File Explorer

66c25b056feae73374a9cb4db0469c94d0a1d2d91cfe09cad1e890e72d5bfb70.exe

.exe 181KB

66c25b056feae73374a9cb4db0469c94d0a1d2d91cfe09cad1e890e72d5bfb70.exe

SHA256 66c25b056feae73374a9cb4db0469c94d0a1d2d91cfe09cad1e890e72d5bfb70
MD5 9b8994e3996f1ff8b74de9098fcc0b17
SHA1 214ef15343ba733a307f2e13512d57b124e9a07d
SHA512 fe40d58d03f9821f146154bf4f9bde780ec896e2677e9eeb990d83aac2e181c0be717e544bf2a7c6b16dcd6c0b4e29d982c96e89b655063d46dbceb6d7e1ccac
SSDEEP 3072:3PlfxikQCGvR5XR3If1+WN6W5qLi0Ygq/V9lOK1OEHKTAVeZsKGOSUh:8CENIthN6W5qeDXd9NOgKxqJOSi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths