MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 240765219e29cbd4f16dd03816f195e14917b2ca0c6ddf35bbf26343a87c8434. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fabookie


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 240765219e29cbd4f16dd03816f195e14917b2ca0c6ddf35bbf26343a87c8434
SHA3-384 hash: 1917410b03a97ebd62d29d71c8a1689bd646f875cc2fdf457d44175790e4db4a59e401b63a75d857f10bfd2b31c610f7
SHA1 hash: 3f798abe1b5141f6541b86705b369a99519f6ae3
MD5 hash: 0a77653eb6749fad4d0dfefe5819816e
humanhash: south-uniform-pasta-august
File name:file
Download: download sample
Signature Fabookie
Create hunting rule
File size:606'208 bytes
First seen:2023-03-26 11:29:12 UTC
Last seen:2023-03-27 07:54:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4673ad56625d375f2efee239af061364 (21 x Fabookie)
ssdeep 12288:G72WP3/jlx8Xr3lRkRc4YFwjsWOfRg6gtPbcTTn7qxerx7:qP3/fWr3/kRc4l6g6gtPbcHn7q
Threatray 67 similar samples on MalwareBazaar
TLSH T13AD4DF81B39095D9C8B88430C693CA71CA317C64DB28569BB7D4BB6F2F32AF16537316
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 60c8d86aec66d4f0 (24 x Fabookie, 1 x DanaBot)
Reporter andretavare5
Tags:exe Fabookie


Avatar
andretavare5
Sample downloaded from http://ji.jhia6gyygcc.com/m/ss25.exe

Intelligence

File Origin
# of uploads :
7
# of downloads :
236
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-03-26 11:31:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3b4c0c90-dc45-48a8-9b36-ccf5817c0f77

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/377529/
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Query of malicious DNS domain
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/74958/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated shell32.dll
Link:
https://www.filescan.io/uploads/64202cbc80ca4ca1ff5960d2/reports/874c2f19-57d7-4fb1-bfe4-610732e83a1b/overview
Verdict:
Malicious
Labled as:
Win64/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/240765219e29cbd4f16dd03816f195e14917b2ca0c6ddf35bbf26343a87c8434
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/eebae814-e933-4459-a322-f86e3336f9bd
Result
Threat name:
Fabookie
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1202118
Signature
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Fabookie
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/240765219e29cbd4f16dd03816f195e14917b2ca0c6ddf35bbf26343a87c8434/
Threat name:
Win64.Trojan.Privateloader
Create hunting rule
Status:
Suspicious
First seen:
2023-03-26 10:00:36 UTC
File Type:
PE+ (Exe)
Extracted files:
90
AV detection:
12 of 37 (32.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eqdwkim6fhf5j4ln2a4bn4mv4ferpmwkbrw56nn36jruhkd4qq2a._file
Verdict:
suspicious
Similar samples:
1670e8390a0d65edc5f7bf18568d692d88761f03a9d2e447652d9455b69826cb
Fabookie
265fb8ad935504f6f91d2c7e177a70d766dd037f9137f1d0657eeb155c829886
Fabookie
3866e15b1b14e1ee2f769e64369f6bb98c03a55afe4461b6524e25141fa66a2d
Fabookie
43e4574bbe757104766b7299c8ebf76026f0932b079e6a0ecd4325f6c0ddb36f
Fabookie
5391a7633161e6b598557a56d313b89d27619d4f819566f8c808f84522bdef4f
Fabookie
5d3fda956dbacd390ecd4247b81008f122ac68ab5b001c612e2216d81f917f53
Fabookie
83442c64c821f32924261167941da1d7e51aa6d35e57c4ac1cdefd2358d876ab
Fabookie
abf9055ecd138cf00061982957d9f141006743f7f967c478b0acf4aace79012b
Fabookie
bb7b0935273ea7fc462a193d7eaa2a30ccc4c808bf152f389125e519c22a9069
Fabookie
c16b3e719af71f08089bfb812352979cdc2bec3b194d12ee6e46da17206dd3a7
Fabookie
+ 57 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230326-nl53zsgc97/
Behaviour
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
240765219e29cbd4f16dd03816f195e14917b2ca0c6ddf35bbf26343a87c8434
MD5 hash:
0a77653eb6749fad4d0dfefe5819816e
SHA1 hash:
3f798abe1b5141f6541b86705b369a99519f6ae3
Link:
https://www.unpac.me/results/1b1fa1fc-5a87-4ab0-8305-61c728eab57c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/240765219e29cbd4f16dd03816f195e14917b2ca0c6ddf35bbf26343a87c8434

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/377529/
  
URLhaus
https://urlhaus.abuse.ch/url/2561770/

Comments