formbook | 632-11-0x0000000000400000-0x000000000042F000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
632-11-0x0000000000400000-0x000000000042F000-memory.dmp
Size 188KB
Sample240606-rt2mbafd5y
SHA256 4035f56f7a1f315ef04cc0ac6542623a23587d98a2acd41d3ce58c4bcbb50269
MD5 2b417509a64894c18795307669ab69d6
SHA1 e760615800d9d62223d9ed3c20131cf4eddf2c8b
SHA512 e4c8138d40cc8349229797bdc53c342ba43b91fd96eac845f8efb07bb436b1c231a62ad70aefe50a56153f6b67a766e7fb3fc50fb752f2510395a03dcb0d251d
SSDEEP 3072:3jEEVk7mHnAbk3ia3uafSXagUgI0AbP6JHs4tlLuoda1Bgu0p4l8Z1vkDKdkZOv:QzKi4SagUg4S1sAanop3PvECH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat ss63 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

ss63

Decoy

catpig.xyz
chatladyanzensei7.site
onewayonepaydroptaxi.com
bima188.lol
wealth-km.online
seepao27200.top
6c958u9.lol
fbyu57ytsd.shop
baranetentegre.com
webaichimie.com
h3k38q2.lol
abicomsrl.com
338kp.vip
rescuecube.com
bubatz-t.com
psgluxuryapartments.com
goodfellowlawfirm.com
bais141.com
imingchu.com
ekzeanjfolzaks.top
hanweixn.com
getwalkapp.com
pharm-resources.com
montessorigpt.com
novaprivatecare.com
3656444.com
h61u4oxx4sraqjm.buzz
vak888.life
q43n.top
sushiommen.com
wvinsiders.com
emran-tahhan.com
manipulatedalgorithms.com
presentiei.shop
juntospelors.com
j0a6doy1x8eyx.com
yexoiup.xyz
bricoarq.com
hnxymaritime.com
selllocaljet.com
h5left513.xyz
65yty.com
everymgs01.com
barbaraht.com
mx5cucs.xyz
checkscamsv.com
smpn1madangsuku2.store
mixefy.shop
gacordewa288.life
srisaiprintpack.com
gasdepo168.com
etancheite-ajaccio.com
slow-man.com
thewhitehorsepub.biz
bay6studio.com
djhtshrtshgrg.lol
xcxocez.shop
games.broker
nudkiss.com
ccconnectglobal.com
wifmilio.com
dpuntada.com
ads8562.shop
diferenciaes.com
fashionchc.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
632-11-0x0000000000400000-0x000000000042F000-memory.dmp

File Explorer

632-11-0x0000000000400000-0x000000000042F000-memory.dmp

.exe 188KB

632-11-0x0000000000400000-0x000000000042F000-memory.dmp

SHA256 4035f56f7a1f315ef04cc0ac6542623a23587d98a2acd41d3ce58c4bcbb50269
MD5 2b417509a64894c18795307669ab69d6
SHA1 e760615800d9d62223d9ed3c20131cf4eddf2c8b
SHA512 e4c8138d40cc8349229797bdc53c342ba43b91fd96eac845f8efb07bb436b1c231a62ad70aefe50a56153f6b67a766e7fb3fc50fb752f2510395a03dcb0d251d
SSDEEP 3072:3jEEVk7mHnAbk3ia3uafSXagUgI0AbP6JHs4tlLuoda1Bgu0p4l8Z1vkDKdkZOv:QzKi4SagUg4S1sAanop3PvECH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths