MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f794898e78e756d605b2d7bdb6934e299c895f106f4030187d366d3ba543f24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Fabookie

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	7f794898e78e756d605b2d7bdb6934e299c895f106f4030187d366d3ba543f24
SHA3-384 hash:	048674e37247635143124fa81def1f9e771fcc7df326d36455cce69dd3e3e7d3fd9ed248325a370d18d3468f961cd3d0
SHA1 hash:	ccb142ce80b679d3c7d1b595d8c3a212e2c1f4a6
MD5 hash:	a86536cf3a0686f35f9a7c7d3eb636a7
humanhash:	oregon-arkansas-sierra-berlin
File name:	ss41.exe
Download:	download sample
Signature	Fabookie Create hunting rule
File size:	732'672 bytes
First seen:	2023-08-24 16:39:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f2fcd0efb031ebebeaa83cd4cd21090b (24 x Fabookie)
ssdeep	6144:XA01NdkuvxQWQ1GYaE5VinydRxQ7cUBmCUiJbc77ZvfuYuEdGxTC2sWf7xLUnw+V:XdL5QW++nyIShtdGxTC2c5JL
Threatray	453 similar samples on MalwareBazaar
TLSH	T142F42B56FBBD4272E051C135C9A6E7B5E6B27C855D30970B2346EB2E2F335118E3AB20
TrID	31.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 24.5% (.SCR) Windows screen saver (13097/50/3) 19.7% (.EXE) Win64 Executable (generic) (10523/12/4) 9.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	6cd2a3b79393d070 (24 x Fabookie, 1 x AgentTesla)
Reporter	dancho_danchev
Tags:	exe Fabookie

Intelligence

File Origin

# of uploads :

# of downloads :

283

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

SecuriteInfo.com.Trojan.MulDropNET.43.23142.19432

Verdict:

Malicious activity

Analysis date:

2023-08-24 07:28:39 UTC

Tags:

amadey trojan loader fabookie stealer smoke

Link:

https://app.any.run/tasks/8406c2d0-e702-4b9b-940b-f9d21cd4d679

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/444571/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader45.60881.17944.20601.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Sending an HTTP GET request

DNS request

Query of malicious DNS domain

Sending a TCP request to an infection source

Sending an HTTP GET request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin shell32 swrort

Link:

https://www.filescan.io/uploads/64e787e4aa97e3ec0d1aeef0/reports/ec190322-e164-43a1-9505-e471c6c2f033/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7f794898e78e756d605b2d7bdb6934e299c895f106f4030187d366d3ba543f24

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/f75deeee-ca97-4353-a062-ec54e685a36a

Result

Threat name:

Fabookie

Detection:

malicious

Classification:

troj.spyw

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1296864

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Contains functionality to steal Chrome passwords or cookies

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Fabookie

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7f794898e78e756d605b2d7bdb6934e299c895f106f4030187d366d3ba543f24/

Threat name:

Win64.Trojan.Swrort

Status:

Malicious

First seen:

2023-08-23 14:56:18 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

17 of 36 (47.22%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=p54urghhrz2w2yc3fv55w2ju4km4rfpra32agamh2ntnhosuh4sa._file

Verdict:

malicious

Fabookie

4a8b6a3e837ed8d977973cc385a5cda8ef78157994323d152e157eea714d05ad

Fabookie

6000f428bfd3149bfcab76cbfa53385e71d2c99539b78d2b5e671d4721d6c2c7

Fabookie

645168fedeed9948b5103f10d52c9adf1133358e1b1ab4ac0893dd3bb73b2df5

Fabookie

ac4620769b15f5a7ccbeda9891ab788e46fe418e8129b2d54a64452467ac9eb0

Fabookie

adeeb5ab4974433126bf0c2d15234dc13fcd577217babbf0d352517ec588b7af

Fabookie

d440158b91d965693007b539131704b3bdd72e864b5adc1c0e230213acd3d97b

Fabookie

ee1e789a40e3cc8ff607726cbe0a8b72b86a51e933787a7074ac6c0b58bc59c7

Fabookie

fec5e8cb13f8418df2d3c2188c40eb2844084b02bdd9f2a899690b3a7b25986c

Fabookie

+ 443 additional samples on MalwareBazaar

Result

Malware family:

fabookie

Score:

10/10

Tags:

family:fabookie spyware stealer

Link:

https://tria.ge/reports/230824-t6h2vafe5z/

Behaviour

Modifies system certificate store

Reads user/profile data of web browsers

Detect Fabookie payload

Fabookie

Unpacked files

SH256 hash:

7f794898e78e756d605b2d7bdb6934e299c895f106f4030187d366d3ba543f24

MD5 hash:

a86536cf3a0686f35f9a7c7d3eb636a7

SHA1 hash:

ccb142ce80b679d3c7d1b595d8c3a212e2c1f4a6

Link:

https://www.unpac.me/results/9bc90e94-d9a9-49aa-87ee-b22d9c1dcd31/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7f794898e78e756d605b2d7bdb6934e299c895f106f4030187d366d3ba543f24

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.