MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77f3721e67620f78a5870dfa2ecf173f1ceefc4ea6d72867bd1e2850ff8ddbdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fabookie


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77f3721e67620f78a5870dfa2ecf173f1ceefc4ea6d72867bd1e2850ff8ddbdf
SHA3-384 hash: bbe33498a382879e1e1f07a89b8f40859edf8d8b18a9e2566f8967ab39399eb684e32cd32d7836a2e7517395235e6d83
SHA1 hash: 5785d7551bb1c94552ca30f614ef1def16c94714
MD5 hash: 12acc2264a596400b990f60f544bced3
humanhash: nevada-burger-low-pasta
File name:12acc2264a596400b990f60f544bced3.exe
Download: download sample
Signature Fabookie
Create hunting rule
File size:322'048 bytes
First seen:2023-03-28 17:52:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a7a19cad0c2c193feb43fc00c1b6b502 (17 x Fabookie)
ssdeep 3072:P8k/TMYQ0qIN6NtVcOXEK5ULDGyUPj09vJqxEm4x1ESuQG+3SeyRS6CSfKVu1xgP:5Mnt3EPXAPj2voxEvTEPp/F
Threatray 81 similar samples on MalwareBazaar
TLSH T1B3643B156FB91DB6C016B43F0C6E84524B337827162783F7E496DEAC0EF76E8D466822
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon e3b1adeddd75ad92 (15 x Fabookie)
Reporter abuse_ch
Tags:exe Fabookie

Intelligence

File Origin
# of uploads :
1
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
12acc2264a596400b990f60f544bced3.exe
Verdict:
Malicious activity
Analysis date:
2023-03-28 17:56:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b4f8f232-44d6-4892-ad29-d9776cc39bf3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/378275/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Query of malicious DNS domain
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/75481/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
No Threat
Threat level:
  2/10
Confidence:
83%
Tags:
setupapi.dll
Link:
https://www.filescan.io/uploads/64232984f7dd2dc86f479342/reports/18df20ea-b3f0-4e3a-90fc-59d18afcc7c9/overview
Verdict:
Malicious
Labled as:
Trojan.Fabookie
Link:
https://www.hybrid-analysis.com/sample/77f3721e67620f78a5870dfa2ecf173f1ceefc4ea6d72867bd1e2850ff8ddbdf
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d37f335a-0894-496e-bda6-571a3b9cdf43
Result
Threat name:
Fabookie
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1203727
Signature
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Fabookie
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77f3721e67620f78a5870dfa2ecf173f1ceefc4ea6d72867bd1e2850ff8ddbdf/
Threat name:
Win64.Adware.RedCap
Create hunting rule
Status:
Malicious
First seen:
2023-03-28 13:04:02 UTC
File Type:
PE+ (Exe)
Extracted files:
26
AV detection:
9 of 24 (37.50%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o7zxehthmihxrjmhbx5c5tyxh4oo57cou3lsqz55dyufb74n3ppq._file
Verdict:
suspicious
Similar samples:
1670e8390a0d65edc5f7bf18568d692d88761f03a9d2e447652d9455b69826cb
Fabookie
32ac0624a534a2c40fb8eba41e80bb1d31b99cd118d42208c89229079699f783
Fabookie
3866e15b1b14e1ee2f769e64369f6bb98c03a55afe4461b6524e25141fa66a2d
Fabookie
508811d6e7bba94362c9412a2c40cc376e325e1e22f7fefdf49f799c7e6e7baf
Fabookie
5d3fda956dbacd390ecd4247b81008f122ac68ab5b001c612e2216d81f917f53
Fabookie
99bff3978b5f96827225108dfe3cd76da63b6e18c42161f3433e73db431ae87b
Fabookie
abf9055ecd138cf00061982957d9f141006743f7f967c478b0acf4aace79012b
Fabookie
c16b3e719af71f08089bfb812352979cdc2bec3b194d12ee6e46da17206dd3a7
Fabookie
db7ea1a496e6e1af76d6c63f29ed0472224edbf2b7abb2803d98c0957789bf39
Fabookie
dd2f34dc49d52d4f36a36ded298705f8f83c91a7c7dfdde3f05413b10a323b0e
Fabookie
+ 71 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230328-wgaehscd32/
Behaviour
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
77f3721e67620f78a5870dfa2ecf173f1ceefc4ea6d72867bd1e2850ff8ddbdf
MD5 hash:
12acc2264a596400b990f60f544bced3
SHA1 hash:
5785d7551bb1c94552ca30f614ef1def16c94714
Link:
https://www.unpac.me/results/8399081a-b3e9-4a0c-95e2-d87fa2a6212a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/77f3721e67620f78a5870dfa2ecf173f1ceefc4ea6d72867bd1e2850ff8ddbdf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fabookie

Executable exe 77f3721e67620f78a5870dfa2ecf173f1ceefc4ea6d72867bd1e2850ff8ddbdf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2561770/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/378275/

Comments