MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d382caf21dcbe7dbae511e238852798c9b11b69cbc02ff46916e7c47f24c8e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Fabookie

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	6d382caf21dcbe7dbae511e238852798c9b11b69cbc02ff46916e7c47f24c8e2
SHA3-384 hash:	95bbbf1114338cdfe24e746ad4b9a8c14bfcdae5a18cbc2209b91e97181032fdb35f9dd792c090fcd1af38a26c904399
SHA1 hash:	8651025c9406320f01c7b579d469608368e2fefa
MD5 hash:	783585f4ccf2fb73e35e784169e30745
humanhash:	uranus-pennsylvania-ten-crazy
File name:	783585f4ccf2fb73e35e784169e30745.exe
Download:	download sample
Signature	Fabookie Create hunting rule
File size:	649'728 bytes
First seen:	2023-08-28 09:15:26 UTC
Last seen:	2023-08-28 09:39:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	20a03a21823d3b586003fbd55dedc73d (11 x Fabookie)
ssdeep	12288:TeE9CMmn1yBvivHTPjPTXzGRDJciMuGEPnW:qE9jmn1AuPjPTjGRSiMupnW
Threatray	464 similar samples on MalwareBazaar
TLSH	T18CD47D51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726
TrID	31.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 24.5% (.SCR) Windows screen saver (13097/50/3) 19.7% (.EXE) Win64 Executable (generic) (10523/12/4) 9.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	900ae0f2b3f200c0 (11 x Fabookie)
Reporter	abuse_ch
Tags:	exe Fabookie

Intelligence

File Origin

# of uploads :

# of downloads :

253

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

783585f4ccf2fb73e35e784169e30745.exe

Verdict:

Malicious activity

Analysis date:

2023-08-28 09:16:21 UTC

Tags:

fabookie stealer

Link:

https://app.any.run/tasks/b7307e7c-e22a-4a80-8ed6-d1413f1ade4a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/444872/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader45.61774.5785.6638.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending an HTTP GET request

DNS request

Query of malicious DNS domain

Sending a TCP request to an infection source

Sending an HTTP GET request to an infection source

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

crypto evasive fabookie greyware lolbin shell32

Link:

https://www.filescan.io/uploads/64ec65d5b3b7d7c782d094d7/reports/19fa693d-5f68-4710-9415-3e0c11edd185/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/6d382caf21dcbe7dbae511e238852798c9b11b69cbc02ff46916e7c47f24c8e2

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/3e29d9d3-4242-46f5-87cd-90971ae3c6fe

Result

Threat name:

Fabookie

Detection:

malicious

Classification:

troj.spyw

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1298579

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Contains functionality to steal Chrome passwords or cookies

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Fabookie

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6d382caf21dcbe7dbae511e238852798c9b11b69cbc02ff46916e7c47f24c8e2/

Threat name:

Win64.Trojan.PrivateLoader

Status:

Malicious

First seen:

2023-08-27 06:39:30 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

21 of 38 (55.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nu4czlzb3s7h3oxfchrdrbjhtde3cg3jzpac75djc3t4i7zezdra._file

Verdict:

malicious

Fabookie

645168fedeed9948b5103f10d52c9adf1133358e1b1ab4ac0893dd3bb73b2df5

Fabookie

718fb159a0802f563779496344b77e50ce75f3e1010c8129587603212cf8ce40

Fabookie

ac4620769b15f5a7ccbeda9891ab788e46fe418e8129b2d54a64452467ac9eb0

Fabookie

adeeb5ab4974433126bf0c2d15234dc13fcd577217babbf0d352517ec588b7af

Fabookie

ccb26ef88dfff6653b7b2fc0bbd36ef58a4c8db24c9011f8c7d577dbe544cc3b

Fabookie

d440158b91d965693007b539131704b3bdd72e864b5adc1c0e230213acd3d97b

Fabookie

ee1e789a40e3cc8ff607726cbe0a8b72b86a51e933787a7074ac6c0b58bc59c7

Fabookie

fec5e8cb13f8418df2d3c2188c40eb2844084b02bdd9f2a899690b3a7b25986c

Fabookie

+ 454 additional samples on MalwareBazaar

Result

Malware family:

fabookie

Score:

10/10

Tags:

family:fabookie spyware stealer

Link:

https://tria.ge/reports/230828-k8f6lagf7y/

Behaviour

Modifies system certificate store

Reads user/profile data of web browsers

Detect Fabookie payload

Fabookie

Unpacked files

SH256 hash:

6d382caf21dcbe7dbae511e238852798c9b11b69cbc02ff46916e7c47f24c8e2

MD5 hash:

783585f4ccf2fb73e35e784169e30745

SHA1 hash:

8651025c9406320f01c7b579d469608368e2fefa

Link:

https://www.unpac.me/results/dd636fd0-e06b-48de-a281-0d2648ec181b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6d382caf21dcbe7dbae511e238852798c9b11b69cbc02ff46916e7c47f24c8e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.