MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ddc19ae908947ed753b9681fca56b219204174819c5cd9113dc02ccfa79ced6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Fabookie

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	2ddc19ae908947ed753b9681fca56b219204174819c5cd9113dc02ccfa79ced6
SHA3-384 hash:	6890ce2ea9efb28d87ed1874f5e4e36559e5c340915007c5e189b2398539c49d9455498e87fd555d34b69c7966093e79
SHA1 hash:	63a211e372765322687b0485baa81a93d6ac7d9e
MD5 hash:	b33cfeeae0e54ce730e12bb76cfa9be1
humanhash:	william-florida-floor-nevada
File name:	b33cfeeae0e54ce730e12bb76cfa9be1.exe
Download:	download sample
Signature	Fabookie Create hunting rule
File size:	649'728 bytes
First seen:	2023-07-16 07:50:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	20a03a21823d3b586003fbd55dedc73d (11 x Fabookie)
ssdeep	12288:Tee9CNmn1yjnivHTJBxPTXzGwDJciMuGEPnW:qe9imn1+uJBxPTjGwSiMupnW
Threatray	336 similar samples on MalwareBazaar
TLSH	T1DAD47D51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726
TrID	31.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 24.5% (.SCR) Windows screen saver (13097/50/3) 19.7% (.EXE) Win64 Executable (generic) (10523/12/4) 9.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	900ae0f2b3f200c0 (11 x Fabookie)
Reporter	abuse_ch
Tags:	exe Fabookie

Intelligence

File Origin

# of uploads :

# of downloads :

259

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

b33cfeeae0e54ce730e12bb76cfa9be1.exe

Verdict:

Malicious activity

Analysis date:

2023-07-16 08:14:26 UTC

Tags:

fabookie stealer

Link:

https://app.any.run/tasks/885d8f3a-6315-4d39-bf3c-a1f301767af6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/421046/

Detection(s):

SecuriteInfo.com.Trojan.SuspectCRC.18815.7664.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Query of malicious DNS domain

Sending an HTTP GET request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

crypto evasive fabookie greyware lolbin shell32

Link:

https://www.filescan.io/uploads/64b3a167c7643f862f33c5b9/reports/c3724772-04e1-4eb4-abed-973a575f5192/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2ddc19ae908947ed753b9681fca56b219204174819c5cd9113dc02ccfa79ced6

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/8886ee6c-60c1-4678-9296-6fd545cc6a18

Result

Threat name:

Fabookie

Detection:

malicious

Classification:

troj.spyw.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1273834

Signature

Antivirus detection for URL or domain

Contains functionality to steal Chrome passwords or cookies

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Fabookie

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2ddc19ae908947ed753b9681fca56b219204174819c5cd9113dc02ccfa79ced6/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2023-07-16 07:51:06 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=fxobtluqrfd625j3s2a7zjllegjaif2idhc43eit3qbmz6tzz3la._file

Verdict:

suspicious

Fabookie

1bdd77eb31ca56996af96e2d40bae014049bb4b42dba5f0fe70d49066bacc09f

Fabookie

274f5d3d6967d77475ceee848a0dff2cfc9993923861de020e3856bd54ba8fc7

Fabookie

29ee51c21a3976410dd563dc4ed017f321ce95fdae61a0166af8a25f3b93f88a

Fabookie

4f2f8e8f530beb89c23e7a43a6a82498bd44739688e273f3ea4e4dde4aea38ed

Fabookie

537bfc81c6e52d965810232f0253e4484bd5173c5eb11c0bb122e522cc34fa86

Fabookie

cb9b591fb411abb5ba554f6679775eea77df4b035618f679e5bf11cccf215574

Fabookie

ccd5fed825fdb224d3afdef247fb95b7fb6ae3a5b2e05918043cc497547ed002

Fabookie

ceb1651df489067a66c80b1c3cd1f22133b24b0b02a8cdb78150b51bcface64e

Fabookie

+ 326 additional samples on MalwareBazaar

Result

Malware family:

fabookie

Score:

10/10

Tags:

family:fabookie spyware stealer

Link:

https://tria.ge/reports/230716-jpvn7sdb93/

Behaviour

Reads user/profile data of web browsers

Detect Fabookie payload

Fabookie

Unpacked files

SH256 hash:

2ddc19ae908947ed753b9681fca56b219204174819c5cd9113dc02ccfa79ced6

MD5 hash:

b33cfeeae0e54ce730e12bb76cfa9be1

SHA1 hash:

63a211e372765322687b0485baa81a93d6ac7d9e

Link:

https://www.unpac.me/results/76b825f4-cc2c-4767-90f1-fc9f8e89dc65/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2ddc19ae908947ed753b9681fca56b219204174819c5cd9113dc02ccfa79ced6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers