formbook | fcfda5a7a8b441103c5ba5e977fa23fded824901e5dfe0d47986af8c905dfdd3

Sharing

Copy URL Twitter E-mail

General

Target
fcfda5a7a8b441103c5ba5e977fa23fded824901e5dfe0d47986af8c905dfdd3
Size 188KB
Sample240805-hwe2nazbll
SHA256 fcfda5a7a8b441103c5ba5e977fa23fded824901e5dfe0d47986af8c905dfdd3
MD5 d674420d04397759b874184370eb35c1
SHA1 aede4a3ef6839a2af0a096df44d081e6d89c7af6
SHA512 73bc5bdce21a8fa6ce134c6378c3d7d01fb90ebbdffca4b0d6608debf54276fe2d250ad8f968a9a5f31e82cecee8e3848a4880c7df16837eaacdcfab4d8d34a2
SSDEEP 3072:/SXXk7UgnuF9BEOo3PhtbLZt6o+34KI0sCINxTqML3voe:oAcmPrfH6o+34KIlNZqMD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat md02 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

md02

Decoy

onsen1508.com
partymaxclubmen36.click
texasshelvingwarehouse.com
tiantiying.com
taxcredits-pr.com
33mgbet.com
equipoleiremnacional.com
andrewghita.com
zbbnp.xyz
englandbreaking.com
a1b5v.xyz
vizamag.com
h0lg3.rest
ux-design-courses-17184.bond
of84.top
qqkartel88v1.com
avalynkate.com
cpuk-finance.com
yeslabs.xyz
webuyandsellpa.com
barnesassetrecovery.store
hecxion.xyz
theopencomputeproject.net
breezyvw.christmas
mumazyl.com
woby.xyz
jalaios10.vip
lynxpire.com
sparkbpo.com
333689z.com
rslotrank.win
adscendmfmarketing.com
detroitreels.com
xojiliv1.com
mzhhxxff.xyz
hitcomply.com
piedge-taiko.net
chiri.lat
bookmygaddi.com
hjemfinesse.shop
zruypj169g.top
solarfundis.com
pittsparking.com
teplo-invest.com
j3k7n.xyz
coloradoskinwellness.com
z8ggd.com
coinbureau.xyz
mamasprinkleofjoy.com
xotj7a.xyz
nijssenadventures.com
ysa-cn.com
tigajco69.fun
localhomeservicesadvisor.com
attorney-services-8344642.zone
rnwaifu.xyz
nyverian.com
family-lawyers-7009103.world
117myw.com
kingdom66.lat
tdshomesolution.com
momof2filiricans.com
saeutah.com
rakring.com
upcyclecharms.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fcfda5a7a8b441103c5ba5e977fa23fded824901e5dfe0d47986af8c905dfdd3

File Explorer

fcfda5a7a8b441103c5ba5e977fa23fded824901e5dfe0d47986af8c905dfdd3

.exe 188KB

fcfda5a7a8b441103c5ba5e977fa23fded824901e5dfe0d47986af8c905dfdd3

SHA256 fcfda5a7a8b441103c5ba5e977fa23fded824901e5dfe0d47986af8c905dfdd3
MD5 d674420d04397759b874184370eb35c1
SHA1 aede4a3ef6839a2af0a096df44d081e6d89c7af6
SHA512 73bc5bdce21a8fa6ce134c6378c3d7d01fb90ebbdffca4b0d6608debf54276fe2d250ad8f968a9a5f31e82cecee8e3848a4880c7df16837eaacdcfab4d8d34a2
SSDEEP 3072:/SXXk7UgnuF9BEOo3PhtbLZt6o+34KI0sCINxTqML3voe:oAcmPrfH6o+34KIlNZqMD
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths