formbook | 2372-13-0x0000000000400000-0x000000000042F000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
2372-13-0x0000000000400000-0x000000000042F000-memory.dmp
Size 188KB
Sample240717-vceyrsshpf
SHA256 25a7be305d31af52668e6b9918a5ae09addf65a757c68251613f8dc7fd244d26
MD5 2e76dbd7ed303b5a7a5235f8e9249d37
SHA1 545339f31e1290fc6bc3401cde01485cdd77c8fb
SHA512 0f74bf8b6e32fc3ae5c6e24e350e0b739056db5729c8933a427e216efd9ccc10c83ad6e160ff831ea793c27addc769bea81cc7e0517d9003cccaf9e4f9f9bb33
SSDEEP 3072:KBmakhUeZ5Fv9ajHJkrztPr6u6vAwF1geXMM+/FDpAoO:2graVktD6u6vkPM+/FdAoO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat v15n formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

v15n

Decoy

dyahwoahjuk.store
toysstorm.com
y7rak9.com
2222233p6.shop
betbox2341.com
visualvarta.com
nijssenadventures.com
main-12.site
leng4d.net
kurainu.xyz
hatesa.xyz
culturamosaica.com
supermallify.store
gigboard.app
rxforgive.com
ameliestones.com
kapalwin.live
tier.credit
sobol-ksa.com
faredeal.online
226b.xyz
talktohannaford500.shop
mxrkpkngishbdss.xyz
mirotcg.info
turbo3club.site
hjnd28t010cop.cyou
marveloustep.shop
syedlatief.com
comfortableleather.com
alltradescortland.com
dnwgt80508yoec8pzq.top
kedai168ef.com
gelgoodlife.com
nxtskey.com
milliedevine.store
wordcraftart.fun
mpo525.monster
bt365851.com
dogeversetoken.net
boostgrowmode.com
dacapital.net
project21il.com
go4stores.com
brunoduarte.online
sexgodmasterclass.com
wuhey.shop
jdginl892e.xyz
agenkilat-official.space
hacks.digital
suv.xyz
fwbsmg.life
vicmvm649n.top
wbahdfw.icu
creativelyloud.com
merrycleanteam.com
solar-systems-panels-58747.bond
rotaryclubofmukono.com
bethanyumcnola.info
breezafan.com
ny-robotictoys.com
lawyers-br-pt-9390663.fyi
neurasaudi.com
dgccb.com
sayuri-walk.com
gtur.top

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2372-13-0x0000000000400000-0x000000000042F000-memory.dmp

File Explorer

2372-13-0x0000000000400000-0x000000000042F000-memory.dmp

.exe 188KB

2372-13-0x0000000000400000-0x000000000042F000-memory.dmp

SHA256 25a7be305d31af52668e6b9918a5ae09addf65a757c68251613f8dc7fd244d26
MD5 2e76dbd7ed303b5a7a5235f8e9249d37
SHA1 545339f31e1290fc6bc3401cde01485cdd77c8fb
SHA512 0f74bf8b6e32fc3ae5c6e24e350e0b739056db5729c8933a427e216efd9ccc10c83ad6e160ff831ea793c27addc769bea81cc7e0517d9003cccaf9e4f9f9bb33
SSDEEP 3072:KBmakhUeZ5Fv9ajHJkrztPr6u6vAwF1geXMM+/FDpAoO:2graVktD6u6vkPM+/FdAoO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths