MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e1f14b1ddf671f78f6d82da3520af24f92b382b9a5c3e9e3e26be586cb4bc11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fabookie


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e1f14b1ddf671f78f6d82da3520af24f92b382b9a5c3e9e3e26be586cb4bc11
SHA3-384 hash: 668e5cd33a4a4ba4dcb6bc4da9482da160ced7a6e89cbf9e2f27709fea5eb9979ae5301ffff38e60d61f9a9a67ae5cc9
SHA1 hash: f6635e4e42af347ad9e933d61ed99b18169e8bfc
MD5 hash: 4d7366546d5bf53a645c62608744dee3
humanhash: bluebird-ceiling-oregon-minnesota
File name:4d7366546d5bf53a645c62608744dee3
Download: download sample
Signature Fabookie
Create hunting rule
File size:3'912'192 bytes
First seen:2022-07-23 03:37:50 UTC
Last seen:2022-07-23 04:48:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash bb46f1abb2c1ede95f964a725f9d1284 (123 x Fabookie)
ssdeep 98304:diNz7fytWFibzl1XNIVr5NpOABxysO6R7sqr:YZytRbzlzI1Ogs
Threatray 143 similar samples on MalwareBazaar
TLSH T1EF0612BA62543758C41BC8745933ED05E2F6A21D0FE8EABE75C736C07BEB811D602B46
TrID 45.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.3% (.EXE) OS/2 Executable (generic) (2029/13)
18.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter openctibr
Tags:exe Fabookie OpenCTI.BR Sandboxed

Intelligence

File Origin
# of uploads :
2
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/293566/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.50644295.12085.25447.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62db6d2861945a46c8dae5a3/reports/a792727f-dcb7-4986-9cfc-a49214f286b1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b3538686-846e-467c-9a29-2f6b1b421c02
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1039597
Signature
Antivirus detection for URL or domain
Detected VMProtect packer
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e1f14b1ddf671f78f6d82da3520af24f92b382b9a5c3e9e3e26be586cb4bc11/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-07-15 15:54:14 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
19 of 25 (76.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=byprjmo56zy7pd3nqlndkifpet4swobltjod5hr6e27fq3fuxqiq._file
Verdict:
malicious
Label(s):
icedid
Create hunting rule
Similar samples:
0ed99e4cb0216e8f70d8726de2efde6bde2e5e54f39f8dc35242aaddfa63d6a7
Fabookie
1033088feed24bfafecf502ed6e0919dabda1722d4d03df8b315eb012cc689c2
Fabookie
13c59403bcf5f345aabf97c326be05da95a42f23e04cbd47771f843f3dce5a87
Fabookie
4338db089f48c9426afe5dd4079bed0a4c602b54017d93c8543dab615f2f230b
Fabookie
4561528b6b2c91e27543fc5138746d86665435182be29024cef828531dac29f8
Fabookie
9027ccb4744f40d99a8394a52f2a0f4e88ce44719b053c8d5d041d57b352bcaa
Fabookie
c8e4e15ab56293e0f7a2033600ff45b7dced43f8d1270d323b76b08742ce8626
Fabookie
dd112bfd7911a42d69b370c981ba55c1f1e3e00a671e764c0f1868a928b1fcd5
Fabookie
e6bf53878e3bd911da9408441811c1ea7681c6a6aa0831ca15fd6e6b0349ee1d
Fabookie
f69fb8ffb1b306f76dbbbba681d980d555e7698099d9e56956927912d650364e
Fabookie
+ 133 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
vmprotect
Link:
https://tria.ge/reports/220723-d62wysbge5/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
VMProtect packed file
Unpacked files
SH256 hash:
0e1f14b1ddf671f78f6d82da3520af24f92b382b9a5c3e9e3e26be586cb4bc11
MD5 hash:
4d7366546d5bf53a645c62608744dee3
SHA1 hash:
f6635e4e42af347ad9e933d61ed99b18169e8bfc
Link:
https://www.unpac.me/results/5d8330e5-bdc5-49fa-966c-ae5fc0d9280d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0e1f14b1ddf671f78f6d82da3520af24f92b382b9a5c3e9e3e26be586cb4bc11

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fabookie

Executable exe 0e1f14b1ddf671f78f6d82da3520af24f92b382b9a5c3e9e3e26be586cb4bc11

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2202435/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/293566/

Comments