formbook | bcf3670fe7a029d453f1887f16b97b8577235980909aa282d410cd927fb53a7f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bcf3670fe7a029d453f1887f16b97b8577235980909aa282d410cd927fb53a7f.exe
Size 181KB
Sample240408-jptrxacc53
SHA256 bcf3670fe7a029d453f1887f16b97b8577235980909aa282d410cd927fb53a7f
MD5 8eda69135c5b03a61c9c2b52f7c5e25b
SHA1 38f755a48b65349781c95128f88f115d8cf4ac8c
SHA512 7574fafc8c5f6a19af96cb048758f0f7af03f712014a80b18c28c11533a8679893457d1a20b1bb342cc20f2b38c8365590549965082decdbf384be21c395f662
SSDEEP 3072:zxEUkOmDbSNE3OIF1KLaA6i/hklrQ7Rj4+aYS7JSWoE:VfqO81KaA6ipiaXh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat kh11 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

kh11

Decoy

theluckypaddle.net
assurelinkenterprises.com
gazpachogroup.com
worxservicesllc.com
bestecankurban.com
cotebrief.com
899173.com
navist.io
metaverseharem.com
genpower-plus.com
drhandgrip.com
jessicachristina.com
eidura.com
cat2000andhope1izfanfiction.com
nywaiverlatam.com
cdlb9twt.shop
j2mjewerly.com
itsmisshodges.com
timeis.shop
santefe4g.com
ongame.cloud
guard-dd.online
rutgersorthopedics.com
rkbengg.com
dentalemergencybakersfield.com
jansirani.com
gadilglobal.com
unitygiftingco.store
enxk-32.com
northcuttmediacompany.com
hyyhldz.site
stripperscontest.com
lexcomtech.com
issndiploma.com
shopynuts.site
shpoifypos.app
gamer24.top
dibujosparapintar.net
healthinsuranceudeserve.com
pampadev.tech
whefgf.club
riversandcapital.com
foroupskirt.com
wocan92.top
onehourbookclub.com
brochuresenligne.site
suv-deals-85472.bond
coalswap.com
tresxop.xyz
juniortrevisol.com
it-jobs-87776.bond
black-loan3.shop
chicprems.xyz
pmheiouassessment.shop
186489.support
88mahadewa.vip
vn90129.me
cattaillake.com
jmknoh1r.shop
attitudedancefitness.com
eventcrrate.com
autonomoangola.com
jollshopp.com
thesimplestudio.io
gltip2le.shop

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bcf3670fe7a029d453f1887f16b97b8577235980909aa282d410cd927fb53a7f.exe

File Explorer

bcf3670fe7a029d453f1887f16b97b8577235980909aa282d410cd927fb53a7f.exe

.exe 181KB

bcf3670fe7a029d453f1887f16b97b8577235980909aa282d410cd927fb53a7f.exe

SHA256 bcf3670fe7a029d453f1887f16b97b8577235980909aa282d410cd927fb53a7f
MD5 8eda69135c5b03a61c9c2b52f7c5e25b
SHA1 38f755a48b65349781c95128f88f115d8cf4ac8c
SHA512 7574fafc8c5f6a19af96cb048758f0f7af03f712014a80b18c28c11533a8679893457d1a20b1bb342cc20f2b38c8365590549965082decdbf384be21c395f662
SSDEEP 3072:zxEUkOmDbSNE3OIF1KLaA6i/hklrQ7Rj4+aYS7JSWoE:VfqO81KaA6ipiaXh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths