MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2adc17f082345821c06aea0d9be4980db1b9c147070084bbf7aca14126b229d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Fabookie

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	2adc17f082345821c06aea0d9be4980db1b9c147070084bbf7aca14126b229d5
SHA3-384 hash:	8c55a34333fda389eaf1d3c1954cef196abe3b85bae76740ead2d08fc907b78c667fc3a2cdbafe646d71236761f16b9a
SHA1 hash:	305fae8c65f3fa0919f88f40654e1eab2daa3bdb
MD5 hash:	eb241c86278652a08f432e46ffe7d1f4
humanhash:	thirteen-oregon-queen-stairway
File name:	eb241c86278652a08f432e46ffe7d1f4.exe
Download:	download sample
Signature	Fabookie Create hunting rule
File size:	649'728 bytes
First seen:	2023-08-15 12:52:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	20a03a21823d3b586003fbd55dedc73d (11 x Fabookie)
ssdeep	12288:TeE9CKmx1yjvivHTNBxPTXzGODJciMuGEPnW:qE9Vmx16uNBxPTjGOSiMupnW
Threatray	437 similar samples on MalwareBazaar
TLSH	T14FD47D51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726
TrID	31.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 24.5% (.SCR) Windows screen saver (13097/50/3) 19.7% (.EXE) Win64 Executable (generic) (10523/12/4) 9.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	900ae0f2b3f200c0 (11 x Fabookie)
Reporter	abuse_ch
Tags:	exe Fabookie

Intelligence

File Origin

# of uploads :

# of downloads :

263

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

eb241c86278652a08f432e46ffe7d1f4.exe

Verdict:

Malicious activity

Analysis date:

2023-08-15 12:59:16 UTC

Tags:

fabookie stealer

Link:

https://app.any.run/tasks/607d9a67-2e35-4ca3-a04b-09573fd428ff

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/442832/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader45.61774.26122.30433.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Query of malicious DNS domain

Sending an HTTP GET request to an infection source

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/2adc17f082345821c06aea0d9be4980db1b9c147070084bbf7aca14126b229d5

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/f6888871-16e4-4475-a260-e7e8630022cf

Result

Threat name:

Fabookie

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1291458

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Contains functionality to steal Chrome passwords or cookies

Found stalling execution ending in API Sleep call

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Fabookie

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2adc17f082345821c06aea0d9be4980db1b9c147070084bbf7aca14126b229d5/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2023-08-14 13:33:45 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=flobp4ecgrmcdqdk5igzxzeybwy3tqkha4aijo7xvsqucjvsfhkq._file

Verdict:

malicious

Fabookie

2a4bbe018dc6c5d1af64a4773bd8a7fccba71d19780177308b29b2abea4d33e1

Fabookie

4a8b6a3e837ed8d977973cc385a5cda8ef78157994323d152e157eea714d05ad

Fabookie

7aa6a3dccf29348a58a106ca27606d16e293cd0ec2fae10ec54c9041058d5907

Fabookie

8a2e061b3b38dff83f62982a6b0087e5c4ea1c47192bf0ac2f8f67397636b164

Fabookie

ac4620769b15f5a7ccbeda9891ab788e46fe418e8129b2d54a64452467ac9eb0

Fabookie

ca26e44c17842303c3960abd21b966ede71d30a2f1100f72580a863f5993e28e

Fabookie

ee1e789a40e3cc8ff607726cbe0a8b72b86a51e933787a7074ac6c0b58bc59c7

Fabookie

fec5e8cb13f8418df2d3c2188c40eb2844084b02bdd9f2a899690b3a7b25986c

Fabookie

+ 427 additional samples on MalwareBazaar

Result

Malware family:

fabookie

Score:

10/10

Tags:

family:fabookie spyware stealer

Link:

https://tria.ge/reports/230815-p33jvsah29/

Behaviour

Reads user/profile data of web browsers

Detect Fabookie payload

Fabookie

Unpacked files

SH256 hash:

2adc17f082345821c06aea0d9be4980db1b9c147070084bbf7aca14126b229d5

MD5 hash:

eb241c86278652a08f432e46ffe7d1f4

SHA1 hash:

305fae8c65f3fa0919f88f40654e1eab2daa3bdb

Link:

https://www.unpac.me/results/5eb1f317-3387-48cb-979a-6ad65f860b65/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.