MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82e7dd71b5ff943bb1829fbba1f1903948a98e2ebd901ea6bf15054ec8d3bd47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	82e7dd71b5ff943bb1829fbba1f1903948a98e2ebd901ea6bf15054ec8d3bd47
SHA3-384 hash:	8c013bb207784d3a9bcc99ad655353d49eab46158772f0a991fae5c4f5b10c09b1d22950bf9c51fff7b1a5849fbbedd0
SHA1 hash:	64e89ce81d9e6f64e7455dd4918d2a5987fa2620
MD5 hash:	34e5f4cc8913e0ecc3b2a20ab7df5191
humanhash:	connecticut-video-steak-ack
File name:	file
Download:	download sample
Signature	Fabookie Alert Create hunting rule
File size:	343'552 bytes
First seen:	2023-05-08 04:14:03 UTC
Last seen:	2023-05-10 10:51:06 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ce0c54abf9cb1706cf3f091f1f306b7f (11 x Fabookie)
ssdeep	6144:xFH8RIT6Fam4StJ3/DW49wY7SkDyPiaODgKYleQ4SGP:xWdRDzCUJMeP
TLSH	T1A1741981B3DA4028E072C679CEB18363EA767C155B3096DF07609E6A6F73BE0D531B25
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10523/12/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	70ccc9b3a9cce070 (19 x Fabookie, 3 x XFilesStealer, 1 x Pony)
Reporter	andretavare5
Tags:	exe Fabookie

andretavare5

Sample downloaded from http://ji.uiasehgjj.com/m/ppls25.exe

Intelligence

---

File Origin

# of uploads :

7

# of downloads :

244

Origin country :

US

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-05-08 04:15:53 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/427076e9-fd09-4285-b4c1-f1c867473642

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/387375/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.66928297.18458.22111.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Sending an HTTP GET request

Sending a custom TCP request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/83010/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

EvasionGetTickCount

CheckCmdLine

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

greyware keylogger shell32.dll shell32.dll

Link:

https://www.filescan.io/uploads/64587747c2315c7ec20e6125/reports/7532bbd8-5059-4c24-9131-c80496c8d162/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/82e7dd71b5ff943bb1829fbba1f1903948a98e2ebd901ea6bf15054ec8d3bd47

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Generic Malware

Malware family:

Generic Malware

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c180036f-cb53-4884-b290-8ca0d29f7930

Joe Sandbox Fabookie

Result

Threat name:

Fabookie

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1227947

Signature

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Fabookie

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/82e7dd71b5ff943bb1829fbba1f1903948a98e2ebd901ea6bf15054ec8d3bd47/

ReversingLabs TitaniumCloud Win64.Trojan.Privateloader

Threat name:

Win64.Trojan.Privateloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-07 18:25:54 UTC

File Type:

PE+ (Exe)

Extracted files:

25

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qlt524nv76kdxmmct652d4mqhfektdroxwib5jv7cucu5sgtxvdq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/230508-etpljaag31/

Behaviour

Modifies system certificate store

Reads user/profile data of web browsers

UnpacMe

Unpacked files

SH256 hash:

82e7dd71b5ff943bb1829fbba1f1903948a98e2ebd901ea6bf15054ec8d3bd47

MD5 hash:

34e5f4cc8913e0ecc3b2a20ab7df5191

SHA1 hash:

64e89ce81d9e6f64e7455dd4918d2a5987fa2620

Link:

https://www.unpac.me/results/ee10ed5c-b011-4273-83a4-e4ba3a6a475b/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/82e7dd71b5ff943bb1829fbba1f1903948a98e2ebd901ea6bf15054ec8d3bd47

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Dropped by

PrivateLoader

  

Delivery method

Distributed via drive-by

Cape

https://www.capesandbox.com/analysis/387375/

  

URLhaus

https://urlhaus.abuse.ch/url/2626383/