formbook | 2696-30-0x0000000000400000-0x000000000042F000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
2696-30-0x0000000000400000-0x000000000042F000-memory.dmp
Size 188KB
Sample240607-txrydsba6v
SHA256 bcb64bdb121231d14d58ca0f7dfbe02f14482e1140393bb43436bfeff894cf38
MD5 00d788b363028ff5b6ef7387dd90518f
SHA1 fceaa36e1b23c95d66a5ae6a350af5772c0916b5
SHA512 6d6c2ca526f9b1b12b487f18bb0634315d0361f797c37d00210756ab0e566e85398aeeb681cbc57eef87d3a53cb0606f0a10774cae55633584af37e83e0d4299
SSDEEP 3072:iS28gEJIugehuu433is4VMIma6y5vQU6qg5r0QSoMpQGuOpCJeFVwvl:VIuz4HitV2a95vgH5r0QSoHevLCl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat rn94 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

rn94

Decoy

st68v.xyz
conciergenotary.net
qwechaotk.top
rtpdonatoto29.xyz
8ad.xyz
powermove.top
cameras-30514.bond
vanguardcoffee.shop
umoe53fxc1bsujv.buzz
consultoriamax.net
hplxx.com
ndu.wtf
yzh478c.xyz
bigbrown999.site
xiake07.asia
resdai.xyz
the35678.shop
ba6rf.rest
ceo688.com
phimxhot.xyz
010101-11122-2222.cloud
champion-casino-skw.buzz
laku77.bar
popumail.net
stargazerastrology.click
beauty.university
t460.top
sparkyos.app
day2go.net
minrungis.shop
cognigrid.com
abandoned-houses-39863.bond
liderparti.store
hinet.tech
moviemax.live
business-printer-22001.bond
yakintv.pro
longmaosol.xyz
hello4d.dev
vestircool.store
surpriseinside.net
betflixfan.asia
ln2m1.shop
5302mcavt.website
conf-contact.online
31140.ooo
bdkasinoxox.xyz
nicoleb.tech
mainz-cruise-deals.today
run-run.tokyo
practicalfranchises.info
usmanovbanki-uz.space
superlottery.top
zabbet911.bet
ambassadorshipvottings.click
sangforln.tech
expertoffersusa.lat
plong.cloud
cryptoautomata.dev
dq33xa.xyz
handtools-16660.bond
24763wbk.hair
sportswear-30530.bond
lusuidnx.shop
laske.xyz

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2696-30-0x0000000000400000-0x000000000042F000-memory.dmp

File Explorer

2696-30-0x0000000000400000-0x000000000042F000-memory.dmp

.exe 188KB

2696-30-0x0000000000400000-0x000000000042F000-memory.dmp

SHA256 bcb64bdb121231d14d58ca0f7dfbe02f14482e1140393bb43436bfeff894cf38
MD5 00d788b363028ff5b6ef7387dd90518f
SHA1 fceaa36e1b23c95d66a5ae6a350af5772c0916b5
SHA512 6d6c2ca526f9b1b12b487f18bb0634315d0361f797c37d00210756ab0e566e85398aeeb681cbc57eef87d3a53cb0606f0a10774cae55633584af37e83e0d4299
SSDEEP 3072:iS28gEJIugehuu433is4VMIma6y5vQU6qg5r0QSoMpQGuOpCJeFVwvl:VIuz4HitV2a95vgH5r0QSoHevLCl
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths