formbook | df3ff6ec9e56601719f00f750d26c2b780ceeec523766c5d73d0f61fd4db7dec

Sharing

Copy URL Twitter E-mail

General

Target
df3ff6ec9e56601719f00f750d26c2b780ceeec523766c5d73d0f61fd4db7dec
Size 185KB
Sample240614-aa691swgpg
SHA256 df3ff6ec9e56601719f00f750d26c2b780ceeec523766c5d73d0f61fd4db7dec
MD5 c26a0addc2dccc850439027dee338068
SHA1 a737ad7946b09d5ab6f0bca627c36958761c0866
SHA512 41f81cecf7563d24cd5b99a7b9c0aa358a3eec636717e8b3430c08d29f050963c40ad213ab37e0732988f9b62b7d1274ee494ee7076fcca5345524b363d7c664
SSDEEP 3072:15GfoBk3JzBDmo/03th95Ggq4OWFEcizPFu69YvxtqmMlCz:b2wAatLjq4OWlKM3Dz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat ca63 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

ca63

Decoy

themaxrichth.online
lhzshb.com
isacarrceramics.online
duhochanquoc.website
apexmedia.pro
33311.pro
x2mjbu8gg.shop
dashcreative.online
nifle.shop
hora.lol
rclrwa.asia
aviation-training-sqj.top
a9659a62.vip
uspgh.work
hhol5.top
jinkaida-cn.cn
watchwedding.com
728ym.lat
gillieron.swiss
bingsne.online
professionaljournalism.com
senior-living-15150.bond
chatsio.com
dr-jordan.site
sador.xyz
nagaways.online
552357.pro
domainupdate.site
3v5u21668.shop
dh76044.vip
cineflickapp.online
ht31a.vip
workingcat.online
9h6db.shop
evallc.net
sun20win.digital
683ym.lat
retrosystem.fun
bgkamil.xyz
androidmobiledk.today
gsptx.online
onlineit.sbs
violetnuit.shop
kyusgwh2.top
vdqgj.asia
helpmepeas.net
4399game.asia
tent-homes-10133.bond
moki.dev
raildriver.net
lkjuy.xyz
presentdadsmatter.shop
amp-kopi77i2.xyz
cyber-security-onli.bond
rtpcmbet27.xyz
80lrlaenant8.life
urostatingr.shop
xn--fiq73f39fx0y2hq.work
zc041.xyz
34-health.shop
yunhaicm.asia
domain-2.buzz
money1lifecoachingservice.net
5301ulovp.website
siasstudios.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df3ff6ec9e56601719f00f750d26c2b780ceeec523766c5d73d0f61fd4db7dec

File Explorer

df3ff6ec9e56601719f00f750d26c2b780ceeec523766c5d73d0f61fd4db7dec

.exe 185KB

df3ff6ec9e56601719f00f750d26c2b780ceeec523766c5d73d0f61fd4db7dec

SHA256 df3ff6ec9e56601719f00f750d26c2b780ceeec523766c5d73d0f61fd4db7dec
MD5 c26a0addc2dccc850439027dee338068
SHA1 a737ad7946b09d5ab6f0bca627c36958761c0866
SHA512 41f81cecf7563d24cd5b99a7b9c0aa358a3eec636717e8b3430c08d29f050963c40ad213ab37e0732988f9b62b7d1274ee494ee7076fcca5345524b363d7c664
SSDEEP 3072:15GfoBk3JzBDmo/03th95Ggq4OWFEcizPFu69YvxtqmMlCz:b2wAatLjq4OWlKM3Dz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths