MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f9d101b831275091f28ff87eb66f5a76f8fc724d593704582a8ba541b0b3831. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Fabookie

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	1f9d101b831275091f28ff87eb66f5a76f8fc724d593704582a8ba541b0b3831
SHA3-384 hash:	2e102d38930e843d0397874f84d99320cb66aaa87859b66bf361e8829b04bc1518366e99c2bbe339a3001a11b00e523b
SHA1 hash:	febcb0c34dd7620e58d288809effab5413adea73
MD5 hash:	b1dcc48fc002720b6118ee381b2822d2
humanhash:	indigo-mockingbird-kentucky-texas
File name:	b1dcc48fc002720b6118ee381b2822d2.exe
Download:	download sample
Signature	Fabookie Create hunting rule
File size:	807'936 bytes
First seen:	2023-04-06 15:12:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5f15194ed94be02abab9e9a647ad1555 (2 x Fabookie)
ssdeep	12288:quJUOhk7Yw6+X/P6+X/6YCoPsk7vFIlv:LDYYXg/yg/6YCUsk7vFG
Threatray	97 similar samples on MalwareBazaar
TLSH	T16705AE219122C95BC310343CD885A5F5AADCBC60C759CBE3BA55BC2E7E369A94D3C0F9
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10523/12/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	4c2c600236767221 (6 x Fabookie, 2 x Cosmu)
Reporter	abuse_ch
Tags:	exe Fabookie

Intelligence

File Origin

# of uploads :

# of downloads :

245

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/380671/

Detection(s):

SecuriteInfo.com.W64.Downuk.A.gen.Eldorado.5593.8298.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Sending a custom TCP request

Query of malicious DNS domain

Sending an HTTP GET request to an infection source

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/76834/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

privateloader shell32.dll

Link:

https://www.filescan.io/uploads/642ee1802254dc89120478a8/reports/c0ddadb0-1978-4d2e-a4cd-0eb629f71d4b/overview

Verdict:

Malicious

Labled as:

W64/Downuk.A.gen

Link:

https://www.hybrid-analysis.com/sample/1f9d101b831275091f28ff87eb66f5a76f8fc724d593704582a8ba541b0b3831

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d0101e1d-693d-49fb-8549-f2b0e3f0cbae

Result

Threat name:

Fabookie

Detection:

malicious

Classification:

troj.spyw

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1209785

Signature

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Fabookie

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1f9d101b831275091f28ff87eb66f5a76f8fc724d593704582a8ba541b0b3831/

Threat name:

Win64.Trojan.Privateloader

Status:

Suspicious

First seen:

2023-04-06 11:38:09 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

10 of 35 (28.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=d6orag4dcj2qshzi76d6wzxvu5xy7rze2wjxarmcvc5figylhayq._file

Verdict:

suspicious

Fabookie

0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12

Fabookie

0dde54786dfb33eb21bceba95d017977c7647a553ef91b1fa1dd7742198b6206

Fabookie

48816852a5c4f04278a0073986fe3bfd965baac4c686e47a46de64b3d956e3f5

Fabookie

7bc25b805c7fb261c4ec8ddf78d398e6bbac2f0e066b2469c508b431f44f233e

Fabookie

7e6ba21c2fb7f3f4a422504154c7be3e72380d8770d69fb25eb3a547a6d2ac7e

Fabookie

902387aa87934a342776e8e81b67323957cb9c1d10288567ca8058a4614a30b0

Fabookie

d3e1e0659ff9d7843f91e722d6e94cff0cbf891ab115b7dc23bde7c52a9ead09

Fabookie

dfafc19065140674c7b3e3ffe533f121fe6b2fe1ffb9c0a2dfc15a9d030a0630

Fabookie

+ 87 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/230406-slq2aade92/

Behaviour

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

1f9d101b831275091f28ff87eb66f5a76f8fc724d593704582a8ba541b0b3831

MD5 hash:

b1dcc48fc002720b6118ee381b2822d2

SHA1 hash:

febcb0c34dd7620e58d288809effab5413adea73

Link:

https://www.unpac.me/results/ac5bb5ee-754a-4738-89df-748c1b5728dd/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1f9d101b831275091f28ff87eb66f5a76f8fc724d593704582a8ba541b0b3831

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers