formbook | 2c213fde91ab69ee6d2a0012d3f96a4006856730498d61022c545d4bacf34d2e

Sharing

Copy URL Twitter E-mail

General

Target
2c213fde91ab69ee6d2a0012d3f96a4006856730498d61022c545d4bacf34d2e
Size 188KB
Sample240805-hn4eaayhrp
SHA256 2c213fde91ab69ee6d2a0012d3f96a4006856730498d61022c545d4bacf34d2e
MD5 238c0dd0f3e2f2c1d9028403b2fa3dbd
SHA1 9c4797bc9fc9b2c464ce67e09fd2061d83ea5622
SHA512 88071c56161c3d61177a63a56c37be3035e9cca2a78c9221527d2dd3fa1502ea33ca63cd87d4ac0a66d24b104d51b4c468e6d80a9a38ac3cf61cc3f9e1c8b59c
SSDEEP 3072:z4wEf8uObLGws37JyfqTaaCWx8TZo4+tHGKR/WpXAd+:ePwi7cfBaCWxSZozGc+pXA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat ps15 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

ps15

Decoy

57797.asia
jhpwt.net
basketballdrillsforkids.com
zgzf6.rest
casinomaxnodepositbonus.icu
uptocryptonews.com
gomenasorry.com
fortanix.space
stripscity.xyz
genbotdiy.xyz
mayson-wedding.com
neb-hub.net
seancollinsmusic.com
migraine-treatment-57211.bond
prosperawoman.info
tradefairleads.tech
xn--yeminlitercme-6ob.com
xwaveevent.com
fashiontrendshub.xyz
window-replacement-80823.bond
simplesculpt.online
ellipsive.com
urbandollsllc.com
kgwcmx.xyz
marabudigital.online
abcblindcompany.com
seraphmovement.com
overrideapp.com
holistichealthviews.com
lovemyhome.online
mullermachinery.com
packsperfeitas.shop
gmgex1.com
jlk168.com
xyz-hd.xyz
happysmall.online
phwin777.vip
market-pam.com
kling-ai.xyz
kaidifeiniroo.net
822963429.xyz
bet4win99.com
ryuk-studio.com
tricianihaonewyork.net
plasoi.xyz
mi006.com
briefout.cloud
urbangrowcity.fun
yrund.asia
morningritualtemplate.com
eehuvvqj.xyz
flymgl.com
ux75.top
bluemarblen5d.com
trezorsuite.net
thepeacedealers.com
harlemshake-burgers.com
thesvacha.com
usdj.xyz
stdaev.com
your-coffee-to-talk.com
passrmale.com
resmierabaru20.shop
window-replacement-22581.bond
33pgaaa.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c213fde91ab69ee6d2a0012d3f96a4006856730498d61022c545d4bacf34d2e

File Explorer

2c213fde91ab69ee6d2a0012d3f96a4006856730498d61022c545d4bacf34d2e

.exe 188KB

2c213fde91ab69ee6d2a0012d3f96a4006856730498d61022c545d4bacf34d2e

SHA256 2c213fde91ab69ee6d2a0012d3f96a4006856730498d61022c545d4bacf34d2e
MD5 238c0dd0f3e2f2c1d9028403b2fa3dbd
SHA1 9c4797bc9fc9b2c464ce67e09fd2061d83ea5622
SHA512 88071c56161c3d61177a63a56c37be3035e9cca2a78c9221527d2dd3fa1502ea33ca63cd87d4ac0a66d24b104d51b4c468e6d80a9a38ac3cf61cc3f9e1c8b59c
SSDEEP 3072:z4wEf8uObLGws37JyfqTaaCWx8TZo4+tHGKR/WpXAd+:ePwi7cfBaCWxSZozGc+pXA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127168

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths