formbook | 2504-10-0x0000000000400000-0x000000000042F000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
2504-10-0x0000000000400000-0x000000000042F000-memory.dmp
Size 188KB
Sample240827-v1qp6stdmq
SHA256 6754b5963bba07e441cf02a860634096688c96e1b2adfed271decc15c37ea277
MD5 10da4a342fa4cbca044dfa304bb84640
SHA1 dc43cfe424ab2080b38ee7099c9b78d2f29de739
SHA512 d7183daccb0803afaefe864a9b1ddf48c4d1764ac4dc314205d272e8493cde0b5402c2cde44c11300f131f03d8a73d3199a328b6f35e089573269174c13f78ae
SSDEEP 3072:fuc69FxST/FBBRWfD83yGvuVrz7Fhbc40cBp3csvZE/94nGN:AM+fDqbWrz7FhvBp3cdFim
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat 38gc formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

38gc

Decoy

fgoz3kry51.asia
vanishingacthairremoval.com
onlinelearningsandbox.com
feluca-egypt.com
goforsourcing.com
hairmadeperfect.com
brockspaydayearners.com
vintagetoj.com
tjandthecampers.com
emkanelajiehes.com
bestundersinkwaterfilter.com
proatta777.com
satuslot.beauty
nicolesbodybutter.com
montecarlogallery.com
homeautomation.one
cx-n1.ink
spennys.casa
gaozgn.cfd
hakajimai.online
ghorshed95.com
writingmentor.pro
lyallpuronline.com
china-gb.net
realizare-site.net
welding-ceramics.com
5q72q.top
24hlondon.info
nequiapp.fun
td-group.net
bvrgu.top
cliffderksen.com
stusipad.com
echoeshopnet.shop
aayan-resume.com
buyingcentercleveland.com
wildstyle.nyc
wupdrld.top
wellnesswithpami.com
5ce3p.com
313bets.com
renzkaliloalio40.click
devlab.online
macgyverindustries.com
schuxue.fun
b3995.vip
wengweng.buzz
contactelec.biz
nbttaxes.com
doodlelite.com
rtke1r.cfd
xiemiav.vip
wikistr.com
velvetvortex.top
bestcryptominer.com
171wykehamrdwashington.com
mkhsk.com
notyoursahm.com
illumemgmt.com
finance-profil.com
sokepide.com
purchaseonline.store
subervisual.com
sirnote.com
citizens4daniellee.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2504-10-0x0000000000400000-0x000000000042F000-memory.dmp

File Explorer

2504-10-0x0000000000400000-0x000000000042F000-memory.dmp

.exe 188KB

2504-10-0x0000000000400000-0x000000000042F000-memory.dmp

SHA256 6754b5963bba07e441cf02a860634096688c96e1b2adfed271decc15c37ea277
MD5 10da4a342fa4cbca044dfa304bb84640
SHA1 dc43cfe424ab2080b38ee7099c9b78d2f29de739
SHA512 d7183daccb0803afaefe864a9b1ddf48c4d1764ac4dc314205d272e8493cde0b5402c2cde44c11300f131f03d8a73d3199a328b6f35e089573269174c13f78ae
SSDEEP 3072:fuc69FxST/FBBRWfD83yGvuVrz7Fhbc40cBp3csvZE/94nGN:AM+fDqbWrz7FhvBp3cdFim
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths