MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ec2e908cb0ec7053e456e6f1c1223a24979f7c0628798ffe22d8c8c575031f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fabookie


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ec2e908cb0ec7053e456e6f1c1223a24979f7c0628798ffe22d8c8c575031f9
SHA3-384 hash: d411b33d507e4973d97f9fb6c9b3b5ea9c37bd4414773a83a55db5f05175c0fa31db22cc5828520c79bd5110ce193a29
SHA1 hash: ac21edbbf16f053d5aab864df03cdf7b273e4551
MD5 hash: 8cb1aab16a61fae45dc58e58f26224e3
humanhash: jig-william-maryland-ack
File name:8cb1aab16a61fae45dc58e58f26224e3.exe
Download: download sample
Signature Fabookie
Create hunting rule
File size:281'088 bytes
First seen:2023-04-05 13:15:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ac95dacb2904d888e6ef077884b26ac7 (1 x Fabookie)
ssdeep 6144:qYwUqOWBsx0napCxjg1gSYA/Ui+2rgMCL:XwW3RpCjCcixWL
Threatray 96 similar samples on MalwareBazaar
TLSH T18954AF4A739611FAE0768234C8665A01E37278391F22D75FAA6432377F233909D3BB75
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 63d08a969ac6dc23 (4 x Fabookie)
Reporter abuse_ch
Tags:exe Fabookie

Intelligence

File Origin
# of uploads :
1
# of downloads :
228
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8cb1aab16a61fae45dc58e58f26224e3.exe
Verdict:
Malicious activity
Analysis date:
2023-04-05 13:21:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/abd71ce6-39df-427c-800a-1b70ee0485cd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/380342/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.66252513.29354.4569.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
DNS request
Sending a custom TCP request
Query of malicious DNS domain
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/76661/overview
Behaviour
MalwareBazaar
MeasuringTime
GetTempPath
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/642d749e5df5c94ab9b87ae2/reports/6ec53467-41a5-43d6-97bf-df7186fa1866/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/4ec2e908cb0ec7053e456e6f1c1223a24979f7c0628798ffe22d8c8c575031f9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/aafca7e7-a06f-4d98-9737-7ff3d9bd77a1
Result
Threat name:
Fabookie
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1209054
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Fabookie
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ec2e908cb0ec7053e456e6f1c1223a24979f7c0628798ffe22d8c8c575031f9/
Threat name:
Win64.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-04-04 21:06:07 UTC
File Type:
PE+ (Exe)
Extracted files:
9
AV detection:
13 of 36 (36.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j3boscglb3dqkpsfnzxryerdujext56amkdzr77cfwgiyv2qgh4q._file
Verdict:
malicious
Similar samples:
0177e5347dc981c4a60f0aa5a609a104d0dd6b9bac0b40071e6aa50f5dd45b54
Fabookie
0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12
Fabookie
0dde54786dfb33eb21bceba95d017977c7647a553ef91b1fa1dd7742198b6206
Fabookie
48816852a5c4f04278a0073986fe3bfd965baac4c686e47a46de64b3d956e3f5
Fabookie
7bc25b805c7fb261c4ec8ddf78d398e6bbac2f0e066b2469c508b431f44f233e
Fabookie
7e6ba21c2fb7f3f4a422504154c7be3e72380d8770d69fb25eb3a547a6d2ac7e
Fabookie
902387aa87934a342776e8e81b67323957cb9c1d10288567ca8058a4614a30b0
Fabookie
d3e1e0659ff9d7843f91e722d6e94cff0cbf891ab115b7dc23bde7c52a9ead09
Fabookie
dfafc19065140674c7b3e3ffe533f121fe6b2fe1ffb9c0a2dfc15a9d030a0630
Fabookie
+ 86 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230405-qhvh7agh4s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
4ec2e908cb0ec7053e456e6f1c1223a24979f7c0628798ffe22d8c8c575031f9
MD5 hash:
8cb1aab16a61fae45dc58e58f26224e3
SHA1 hash:
ac21edbbf16f053d5aab864df03cdf7b273e4551
Link:
https://www.unpac.me/results/7577795b-7c0d-40e6-b285-00e547fe9e8b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4ec2e908cb0ec7053e456e6f1c1223a24979f7c0628798ffe22d8c8c575031f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fabookie

Executable exe 4ec2e908cb0ec7053e456e6f1c1223a24979f7c0628798ffe22d8c8c575031f9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2594534/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/380342/

Comments