MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f350bbc4a369d8c9778d9099309960492fffeda8ee980211a49d86ad4c9fee9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Fabookie

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments 1

SHA256 hash:	3f350bbc4a369d8c9778d9099309960492fffeda8ee980211a49d86ad4c9fee9
SHA3-384 hash:	59d1b80ce85a1a0b20c8f0c97a14af353c0dc7a58532fd05aed2422d9fc395aabe2a84c821ef4b18f53e5306b4c1c38a
SHA1 hash:	56e654dfe090acfd0a95ab6598cef5776470c77e
MD5 hash:	e23a2bebaecf866bb1757968fbbf47a0
humanhash:	spaghetti-earth-mobile-venus
File name:	e23a2bebaecf866bb1757968fbbf47a0
Download:	download sample
Signature	Fabookie Create hunting rule
File size:	3'935'232 bytes
First seen:	2022-08-19 07:12:41 UTC
Last seen:	2022-08-19 07:31:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	bb46f1abb2c1ede95f964a725f9d1284 (123 x Fabookie)
ssdeep	49152:/OELy1vrfAoj4d0UR1k3zIkB0sy/UUvTfu6twZrpRxiQ8Ka2WPg1vdUP4rVyDdRk:Tevkf0UfkXB0qIwRifPSfbx6USguu
Threatray	163 similar samples on MalwareBazaar
TLSH	T1840612FE2244335CC41AC8788833FD4972B5D11E0AED99AD74DB7BA07B5B464EA42F42
TrID	45.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.3% (.EXE) OS/2 Executable (generic) (2029/13) 18.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter	zbetcheckin
Tags:	exe Fabookie

Intelligence

File Origin

# of uploads :

# of downloads :

313

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

http://www.mp3statycy.top/mp3studios_9.exe

Verdict:

Malicious activity

Analysis date:

2022-08-15 09:19:01 UTC

Tags:

loader evasion

Link:

https://app.any.run/tasks/95fa3f21-ddb9-497a-9278-9d5a924c4e1a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/299729/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.61308626.15557.16825.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

DNS request

Sending an HTTP GET request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed wacatac

Link:

https://www.filescan.io/uploads/62ff381aeb0bf1e2c6edf692/reports/f3c8a3f1-a706-4664-8897-6fcd871ffbc3/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/82336583-eb28-4f0f-8036-9d493c89ea88

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.spyw

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1054249

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected VMProtect packer

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3f350bbc4a369d8c9778d9099309960492fffeda8ee980211a49d86ad4c9fee9/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2022-08-15 09:09:00 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h42qxpckg2oyzf3y3eezgcmwasjp77w2r3uyaii2jhmgvvgj73uq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

vmprotect

Link:

https://tria.ge/reports/220819-h13cracgh4/

Behaviour

Looks up external IP address via web service

VMProtect packed file

Unpacked files

SH256 hash:

3f350bbc4a369d8c9778d9099309960492fffeda8ee980211a49d86ad4c9fee9

MD5 hash:

e23a2bebaecf866bb1757968fbbf47a0

SHA1 hash:

56e654dfe090acfd0a95ab6598cef5776470c77e

Link:

https://www.unpac.me/results/7ab9b006-e204-4ffb-ad46-75d45067300d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.08

Link:

https://yomi.yoroi.company/submissions/3f350bbc4a369d8c9778d9099309960492fffeda8ee980211a49d86ad4c9fee9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.