MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c153ecb0cc0b6c1c4d3033c806bee89285db6e37902df15ebc4c85b46f24338. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Fabookie

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	7c153ecb0cc0b6c1c4d3033c806bee89285db6e37902df15ebc4c85b46f24338
SHA3-384 hash:	27db9569c96a782df7d72afb61e8c08e2b73a6e690a5a94086494d365d47fae0ed1c99b4ef79a9b23fdf4130dd1f0ffb
SHA1 hash:	7b23829f204f800a08999af58f7e4933c2d59898
MD5 hash:	004a327d652788f5bc5fd38ea3ea69e2
humanhash:	coffee-one-monkey-kitten
File name:	004a327d652788f5bc5fd38ea3ea69e2.exe
Download:	download sample
Signature	Fabookie Create hunting rule
File size:	430'080 bytes
First seen:	2023-08-28 09:14:42 UTC
Last seen:	2023-08-28 09:39:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d1884757532ce7b0014241f40262c929 (16 x Fabookie)
ssdeep	6144:ul073J3gYxsK4ibO9rADW64t0+eoJAbB3T+cbJp:z3JwYiKdqEU0+5cCIJp
Threatray	465 similar samples on MalwareBazaar
TLSH	T14C949ED2E25040E5D477C2B982734B62E7F27C285F214ADF4659B6292F337D28936A0B
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10523/12/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	70646666fab4b064 (18 x Fabookie, 5 x GuLoader)
Reporter	abuse_ch
Tags:	exe Fabookie

Intelligence

File Origin

# of uploads :

# of downloads :

254

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

004a327d652788f5bc5fd38ea3ea69e2.exe

Verdict:

Malicious activity

Analysis date:

2023-08-28 09:16:23 UTC

Tags:

fabookie stealer

Link:

https://app.any.run/tasks/b42c485a-1649-4ff8-8344-c7fa89a0481e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/444867/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader45.60187.5737.19680.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending an HTTP GET request

DNS request

Sending a custom TCP request

Query of malicious DNS domain

Sending a TCP request to an infection source

Sending an HTTP GET request to an infection source

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

keylogger lolbin shell32

Link:

https://www.filescan.io/uploads/64ec659c7444d2eb09f27eaf/reports/b580a9a8-dde5-455c-80e5-7bb468611170/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/7c153ecb0cc0b6c1c4d3033c806bee89285db6e37902df15ebc4c85b46f24338

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/f00e7912-6b01-4eda-b3a4-ad9d1286fd21

Result

Threat name:

Fabookie

Detection:

malicious

Classification:

troj.spyw.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1298569

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Contains functionality to steal Chrome passwords or cookies

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Fabookie

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7c153ecb0cc0b6c1c4d3033c806bee89285db6e37902df15ebc4c85b46f24338/

Threat name:

Win64.Trojan.Lgoogloader

Status:

Suspicious

First seen:

2023-08-27 11:33:04 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

17 of 37 (45.95%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=pqkt5symyc3mdrgtam6ia27oreuf3nxdpebn6fplytefwrxsim4a._file

Verdict:

malicious

Fabookie

4a8b6a3e837ed8d977973cc385a5cda8ef78157994323d152e157eea714d05ad

Fabookie

6000f428bfd3149bfcab76cbfa53385e71d2c99539b78d2b5e671d4721d6c2c7

Fabookie

645168fedeed9948b5103f10d52c9adf1133358e1b1ab4ac0893dd3bb73b2df5

Fabookie

ac4620769b15f5a7ccbeda9891ab788e46fe418e8129b2d54a64452467ac9eb0

Fabookie

adeeb5ab4974433126bf0c2d15234dc13fcd577217babbf0d352517ec588b7af

Fabookie

d440158b91d965693007b539131704b3bdd72e864b5adc1c0e230213acd3d97b

Fabookie

ee1e789a40e3cc8ff607726cbe0a8b72b86a51e933787a7074ac6c0b58bc59c7

Fabookie

fec5e8cb13f8418df2d3c2188c40eb2844084b02bdd9f2a899690b3a7b25986c

Fabookie

+ 455 additional samples on MalwareBazaar

Result

Malware family:

fabookie

Score:

10/10

Tags:

family:fabookie spyware stealer

Link:

https://tria.ge/reports/230828-k7w6esbb35/

Behaviour

Modifies system certificate store

Reads user/profile data of web browsers

Detect Fabookie payload

Fabookie

Unpacked files

SH256 hash:

7c153ecb0cc0b6c1c4d3033c806bee89285db6e37902df15ebc4c85b46f24338

MD5 hash:

004a327d652788f5bc5fd38ea3ea69e2

SHA1 hash:

7b23829f204f800a08999af58f7e4933c2d59898

Link:

https://www.unpac.me/results/cb434f3d-20fb-40ef-9942-84c025e54fe2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7c153ecb0cc0b6c1c4d3033c806bee89285db6e37902df15ebc4c85b46f24338

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.