MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Fabookie

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2
SHA3-384 hash:	6f48e2251f7e53500d536a880bef5d58b6dae05206ceaeed84ed058e616dc737d1e1b63c96961ecdf08dd5cec546aa73
SHA1 hash:	d04a20e3bb7ffe5663f69c870457ad4edeb00192
MD5 hash:	8bd874c0500c7112d04cfad6fda75524
humanhash:	uncle-cup-october-december
File name:	SecuriteInfo.com.Trojan.DownLoader45.60905.19173.24804
Download:	download sample
Signature	Fabookie Create hunting rule
File size:	305'664 bytes
First seen:	2023-09-17 13:39:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5f7cc0f5167c2e87d5d2573013f2660f (11 x Fabookie)
ssdeep	6144:kXkMxMrUwCE2kWCZ3j9Z0CI0iNWpxyN90vE:MkMxMqEVBkCInmy90
Threatray	544 similar samples on MalwareBazaar
TLSH	T1D9544812AB25DFB8F0C7C8B6BD70410218E8B4097758B57E96CDCC751A3BC51ADB1AB2
TrID	31.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 24.5% (.SCR) Windows screen saver (13097/50/3) 19.7% (.EXE) Win64 Executable (generic) (10523/12/4) 9.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter	SecuriteInfoCom
Tags:	exe Fabookie

Intelligence

File Origin

# of uploads :

# of downloads :

313

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/449125/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader45.60905.19173.24804.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending an HTTP GET request

DNS request

Query of malicious DNS domain

Sending a TCP request to an infection source

Sending an HTTP GET request to an infection source

Gathering data

Verdict:

Suspicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin msiexec packed shell32 swrort

Link:

https://www.filescan.io/uploads/650701b333582f234ef9d121/reports/6f8bf7d5-c8e6-4d13-add3-3abce134d3f6/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/540e7f30-2bd2-4fcd-9165-7045c6a34b0b

Result

Threat name:

Fabookie

Detection:

malicious

Classification:

troj.spyw

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1309584

Signature

Antivirus detection for URL or domain

Contains functionality to steal Chrome passwords or cookies

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Windows Update Standalone Installer command line found (may be used to bypass UAC)

Yara detected Fabookie

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2/

Threat name:

Win64.Trojan.Swrort

Status:

Malicious

First seen:

2023-09-17 13:40:06 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ekvdnpjprlhi3fm7elhq5gn74hj72zk4a5nkcsrsgl5z4dzvvxba._file

Verdict:

malicious

Fabookie

4389fc9e95b214ac7cf515931ae9153450bcd4ccd7b7bad6a498da723ad602af

Fabookie

55b9813d1377b90813fee3e75da65c9e66666b48aa0b73676ff9af7b0b87474a

Fabookie

69ded352d815114251f0986f1f9d16702f1b33372c23fe8de2cd18ddab231e13

Fabookie

7b0efba8c51a5f83078f28a6db7129d43db9d4ae71818e2f5fb755dc721880dc

Fabookie

9b7521279c87eba673118e8adc6fc14d4822a9e9ae314f6c3c62176f0aa4cc32

Fabookie

aaba19c5746865c10c97ead516ad6a9b606e24fa1f4c2a074fccbc39f7d2e0e6

Fabookie

b07054c987d03e105bf0c826cd0463a01b6565d8fcf4559e6a360bfca713e683

Fabookie

e10be62dd99f927dc48568c4ec02966c35577ae42a9184b44f5f72b502b7c07b

Fabookie

+ 534 additional samples on MalwareBazaar

Result

Malware family:

fabookie

Score:

10/10

Tags:

family:fabookie spyware stealer

Link:

https://tria.ge/reports/230917-qyhvbsdb88/

Behaviour

Modifies system certificate store

Reads user/profile data of web browsers

Detect Fabookie payload

Fabookie

Unpacked files

SH256 hash:

22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

MD5 hash:

8bd874c0500c7112d04cfad6fda75524

SHA1 hash:

d04a20e3bb7ffe5663f69c870457ad4edeb00192

Link:

https://www.unpac.me/results/2890b5d1-8622-4031-a375-12c8a49d983b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.