formbook | 2712-10-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

2712-10-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

05ab8ec1bce22f011c6da0db13fe24af
SHA1

6470bb33133debc6842ecfc35a591b4d29945dee
SHA256

ac8032483689ee51d2555f9dc7947cbd2ffa4dd7b4b852770c4cc8abd745d511
SHA512

467d9dd0b6e679c652bac80c122a1646dac40ac08873b572bd34ae3821c92758696cb0544c92f49755614bc7c1b7ecc57a07e3d275325ec9a3ee6e5bd9f6e04d
SSDEEP

3072:5ZFZzk/XkacJaIK332BnF8g2qFQJxuwYcBAUfbDWC1Hetvcor:vNZM3SnF8RqFQJxdYEAAic

Score

10^/10

rat by21 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

by21

Decoy

digitalillusions.net

changeblue25.com

kitchenwoow.com

grupocontigoalimentacion.com

iranabr.com

embodiedmagic.com

superstoreszone.com

apartments-for-rent-46883.bond

kelbagnole.com

rideskratchlab.com

a06kng.club

saddlebredallstars.xyz

filepd.com

kxetdf.asia

dl39yy.com

jackedsearch.com

exodusprofessionaldetailing.com

ecommerce-40144.bond

uh3b94g3pyczi9t.skin

dcmcc635i.xyz

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2712-10-0x0000000000400000-0x000000000042F000-memory.dmp

Files

2712-10-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB