MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34bef535c27f1f019e0043b2a5613ef7698b0639b3eaa8240155c0d439b759d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fabookie


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34bef535c27f1f019e0043b2a5613ef7698b0639b3eaa8240155c0d439b759d2
SHA3-384 hash: d1dc47852fd02f46daed8c1c8c86ae3253a726f06e7ab0ff903226d434540b0d23ebb18140d4d5c4a0b192194ac9ef1e
SHA1 hash: aaba1b9de488fc99eb6fe816e7b131cd92300fd0
MD5 hash: f6c08e5c4f9948c57bfc569552b92db0
humanhash: utah-illinois-arizona-finch
File name:f6c08e5c4f9948c57bfc569552b92db0.exe
Download: download sample
Signature Fabookie
Create hunting rule
File size:3'653'120 bytes
First seen:2022-12-12 17:23:04 UTC
Last seen:2022-12-12 18:30:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5222e722e78d4a06ff55b37fdde0c333 (13 x Fabookie)
ssdeep 98304:wRtytZtWA+Mut0+fYnXdG5vmOCLfoUn1:wRtybtqj022XUvJC11
Threatray 60 similar samples on MalwareBazaar
TLSH T160F501E96184331CC01AC4359433FD59F276540D4AEAD9BEB6DB7AC077AB420EA06F1B
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:exe Fabookie

Intelligence

File Origin
# of uploads :
2
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f6c08e5c4f9948c57bfc569552b92db0.exe
Verdict:
No threats detected
Analysis date:
2022-12-12 17:37:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1606a49c-7b0f-49d8-a8fc-f7381efb9e93

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/345578/
Detection(s):
SecuriteInfo.com.Win64.Trojan-gen.23859.886.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/639763b3e2c1ea9defe9a3c5/reports/aea58e2b-83fd-45fa-be27-b1f5493e8f44/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/cd7f3c13-bea5-4412-b91c-f32b81bf3560
Result
Threat name:
Fabookie
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1132887
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected VMProtect packer
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Fabookie
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34bef535c27f1f019e0043b2a5613ef7698b0639b3eaa8240155c0d439b759d2/
Threat name:
Win64.Trojan.Fabookie
Create hunting rule
Status:
Malicious
First seen:
2022-12-12 17:24:11 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gs7pknocp4pqdhqaiozkkyj665uywbrzwpvkqjabkxanionxlhja._file
Verdict:
unknown
Similar samples:
36d0988bbecc52a81edde05ecf40562ce878dcf4eb273691a134f825bbc16f34
Fabookie
9869984c762f83d237d05082a6bcaaf680e388a7c9af167e3e28085145996526
Fabookie
bcb26a341e64f4faf00f57e17955a576b6b41768b29a8d556a4f6d1f52320245
Fabookie
d6cde7214122a3c08f0a0c66673ae8c70188740d780cde1b5eb1f839d412a17f
Fabookie
ff764f0ab5f7a6c6fc5358a3bcc556e6d1e96fb80b9c2030f8f46b2d51ef241a
Fabookie
+ 50 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
vmprotect
Link:
https://tria.ge/reports/221212-vypp4aca55/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
VMProtect packed file
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b18de11e-9ca9-4214-8966-ecc6efea56c2
Unpacked files
SH256 hash:
34bef535c27f1f019e0043b2a5613ef7698b0639b3eaa8240155c0d439b759d2
MD5 hash:
f6c08e5c4f9948c57bfc569552b92db0
SHA1 hash:
aaba1b9de488fc99eb6fe816e7b131cd92300fd0
Link:
https://www.unpac.me/results/2a9730a0-eab6-4a93-993e-b4a1699a7c40/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/34bef535c27f1f019e0043b2a5613ef7698b0639b3eaa8240155c0d439b759d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fabookie

Executable exe 34bef535c27f1f019e0043b2a5613ef7698b0639b3eaa8240155c0d439b759d2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2449245/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/345578/

Comments