formbook | 90730e24fccd4f3d0dedf7b7a4c279704028b7f5df897e980348205236d2c059

Sharing

Copy URL Twitter E-mail

General

Target
90730e24fccd4f3d0dedf7b7a4c279704028b7f5df897e980348205236d2c059
Size 185KB
Sample240607-aqz6msfd84
SHA256 90730e24fccd4f3d0dedf7b7a4c279704028b7f5df897e980348205236d2c059
MD5 084646550310ef73d330f47f1726b884
SHA1 7f26a028a2910568ea7d891e7a22e1ca45d4e2b7
SHA512 92a301772535fcdbcaedd3a4524d599137e9721d4eb09e0357b33d858e5df1c1b5897a3d0ffddda98eeeb387ac9900948edc334209e41e8027491ab7ff12e9ec
SSDEEP 3072:YsA4AbFrZp/uCxiK7thcFaFsfKEguca778igdxS8cffEn3SS97aI+n956VGWnT:WzptzfcFeCK/a778ioxS8cXEn3SS9D+W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat qh1n formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

qh1n

Decoy

hyw0902destiny.xyz
mkquan.net
tisml8yn.top
norcliffecapital.com
dennemeyer-antipiracy.com
kastlosa.com
ghsdhzs.com
fdkeatlah.best
pvpvhhhvmk1z5r7.xyz
pumperwopingrld.com
traveloka.website
yunzhizhao.top
wtwvmemphis.com
aquaceen.com
flynovaa.info
qr-sens.events
yihetrading.com
miamipaintingcompany.com
kunikokaizu.shop
kapudianzi.com
als-bikeshop.com
grundse.com
nukinee.com
seven-heavens.net
bdxxfxukaoycsdv.buzz
loxodogeue.shop
developmi.com
otoland-presents.com
abdullahairinternational.com
supportcentredev.com
air-rifle.net
guangkang.net
97b.lat
chatgratis.host
glamourdiscussion.com
pcul9dhd.vip
jlhdesigns.shop
delivous.info
xy-v2ray.buzz
girlxinh69.net
lutesogroup.com
danijelamacura.com
ah0ubr7002.cfd
floralon.online
columbushighbaseballnews.com
rootstoreality.site
kimmizuno.net
zg9tywlubmftzw5ldzeznju.com
gma-sleekair.com
rmsuppliers.online
phundisk.online
hypelandpr.online
yuntingbao.net
word-brain.site
rstelecomjp.com
americandala.com
sistersuni9quedesigns.com
olimpiadent.com
i-plow.net
centralfloridashedmover.com
hamofy.live
downloadsstreams.com
clean-pro-services.com
vimuslifecare.com
ugcsr.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
90730e24fccd4f3d0dedf7b7a4c279704028b7f5df897e980348205236d2c059

File Explorer

90730e24fccd4f3d0dedf7b7a4c279704028b7f5df897e980348205236d2c059

.exe 185KB

90730e24fccd4f3d0dedf7b7a4c279704028b7f5df897e980348205236d2c059

SHA256 90730e24fccd4f3d0dedf7b7a4c279704028b7f5df897e980348205236d2c059
MD5 084646550310ef73d330f47f1726b884
SHA1 7f26a028a2910568ea7d891e7a22e1ca45d4e2b7
SHA512 92a301772535fcdbcaedd3a4524d599137e9721d4eb09e0357b33d858e5df1c1b5897a3d0ffddda98eeeb387ac9900948edc334209e41e8027491ab7ff12e9ec
SSDEEP 3072:YsA4AbFrZp/uCxiK7thcFaFsfKEguca778igdxS8cffEn3SS97aI+n956VGWnT:WzptzfcFeCK/a778ioxS8cXEn3SS9D+W
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths