MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1106829fa9c154f56ecb85298c81e5a232c1f6c7b3ab525bcbd4c0f2f1098cd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fabookie


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1106829fa9c154f56ecb85298c81e5a232c1f6c7b3ab525bcbd4c0f2f1098cd4
SHA3-384 hash: e8de32f14f0b0aaa89a5e5308d1c7a2c6c6787c39a3cb81c148133fd603992307f005fb64bf1747588fa885b05272aa4
SHA1 hash: 3b25243a5329a88a556febe654c200769396981c
MD5 hash: f44419674185b4aa81406c1cbb0b8c7b
humanhash: seventeen-fifteen-stairway-mississippi
File name:f44419674185b4aa81406c1cbb0b8c7b.exe
Download: download sample
Signature Fabookie
Create hunting rule
File size:3'888'128 bytes
First seen:2022-06-13 10:42:46 UTC
Last seen:2022-06-13 12:04:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash bb46f1abb2c1ede95f964a725f9d1284 (123 x Fabookie)
ssdeep 49152:L1RgT5pEjcKccsrcwpZAb7QZD0HarjA8sfL8G4I3wSnr7ZGC0Bzgm2sJRIWa4wVm:jgFpEjfe/pSb8ZD0OA8sfwpCw+hgTdd
Threatray 116 similar samples on MalwareBazaar
TLSH T1390602FD624C3718C41F88309127ED46F1B6662D4AF889B979CBFEC07BAB4449A02F55
TrID 45.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.3% (.EXE) OS/2 Executable (generic) (2029/13)
18.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:exe Fabookie

Intelligence

File Origin
# of uploads :
2
# of downloads :
236
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/279349/
Detection(s):
SecuriteInfo.com.Suspicious.Win32.Save.a.28688.11954.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62a714beaaaafce31fae1c4d/reports/eeb41929-b82f-44fb-8a07-8af26e4fb89b/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/a9b4f205-4b94-468b-80ca-7fcd6909d8ff
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1011946
Signature
Detected VMProtect packer
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1106829fa9c154f56ecb85298c81e5a232c1f6c7b3ab525bcbd4c0f2f1098cd4/
Threat name:
Win64.Trojan.Fabookie
Create hunting rule
Status:
Malicious
First seen:
2022-06-13 10:43:19 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cedifh5jyfkpk3wlquuyzapfuizmd5whwovvew6l2tapf4ijrtka._file
Verdict:
unknown
Similar samples:
054fddf9b41841fad825ef695c4814a5efe2408d154def95eaea59cfee92addb
Fabookie
0d200e6e7d67d35226d40ea4bb1c51b0463d3797057be76ff46d15adf8250861
Fabookie
168def17ca34ac8e71b779064ddda9f3113ed4e4eb99dd24e25793d9ca6e64e1
Fabookie
5e69583874b33475ff03d5e86c6805bd7d60daeac0071138ac62ca0d60131899
Fabookie
6c49edabd61702b5254163c19c7fedb5f009730cb1eb63e9f97f2a760cfbeaed
Fabookie
85584caed38834e9a4fc0625fb464d92cfbc983faa8dbb8f3482f5073a6a5c69
Fabookie
9df3408b1000950b400430c06b7b7bb0b2f54dc7371e877fdf5f8453797a7692
Fabookie
b9126d0fb86a6e511b56542ba5349e5af02195b7ba1f0ec3401e470d74b25980
Fabookie
da813d04992794a2294818acbf269c815cc9279565e967d3f222407b40c50eab
Fabookie
ed00cd1148a9f1c60d5f622a1e255d63cf63bf119abb7125a8ac1bab2c7da416
Fabookie
+ 106 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
vmprotect
Link:
https://tria.ge/reports/220613-mr8wdsffhj/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
VMProtect packed file
Unpacked files
SH256 hash:
1106829fa9c154f56ecb85298c81e5a232c1f6c7b3ab525bcbd4c0f2f1098cd4
MD5 hash:
f44419674185b4aa81406c1cbb0b8c7b
SHA1 hash:
3b25243a5329a88a556febe654c200769396981c
Link:
https://www.unpac.me/results/c23d0ca8-7dd8-474f-a1e3-14bc30475743/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1106829fa9c154f56ecb85298c81e5a232c1f6c7b3ab525bcbd4c0f2f1098cd4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fabookie

Executable exe 1106829fa9c154f56ecb85298c81e5a232c1f6c7b3ab525bcbd4c0f2f1098cd4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2202468/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/279349/

Comments