MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97f12b24e5ae9141902e74706e7b1715a40e172bfd1eafab7271fb584b3b9796. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fabookie


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97f12b24e5ae9141902e74706e7b1715a40e172bfd1eafab7271fb584b3b9796
SHA3-384 hash: 2f98bb962ffd5ac00e26d59751daab56854321a8a1e20ed359db3d97cf4e2a5ef5bd13afac3e22c683085511fb81090c
SHA1 hash: 26d393625e7f649717b6e6593bdf37a3a2aecae0
MD5 hash: b1a9b9c119b15ff10463fb24ce083d00
humanhash: west-pasta-kilo-speaker
File name:b1a9b9c119b15ff10463fb24ce083d00.exe
Download: download sample
Signature Fabookie
Create hunting rule
File size:732'672 bytes
First seen:2023-04-24 14:33:36 UTC
Last seen:2023-04-26 08:01:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 54a4a8876d1423c6fa95d6828708dd32 (5 x Fabookie)
ssdeep 12288:CwtKLXYdOWi1IqB+leXEZCcD8pellpco/zENOeQiV1u:X+CW+lFrApeCoAYeXV
Threatray 117 similar samples on MalwareBazaar
TLSH T142F49E01B6A499B5D079C235CD53CBB69A703C605F108ADB7364FB1E2E333E2953AB19
TrID 44.6% (.EXE) InstallShield setup (43053/19/16)
17.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.5% (.SCR) Windows screen saver (13097/50/3)
10.9% (.EXE) Win64 Executable (generic) (10523/12/4)
5.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon aab2e3e7a323aac0 (5 x Fabookie)
Reporter abuse_ch
Tags:exe Fabookie

Intelligence

File Origin
# of uploads :
2
# of downloads :
236
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b1a9b9c119b15ff10463fb24ce083d00.exe
Verdict:
Malicious activity
Analysis date:
2023-04-24 14:53:27 UTC
Tags:
installer
Link:
https://app.any.run/tasks/ce8c1612-b484-4a8f-9036-d81adcce1372

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/384584/
Detection(s):
SecuriteInfo.com.Trojan-Downloader.Win64.Agent.1092.162.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Query of malicious DNS domain
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/81261/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger shell32.dll
Link:
https://www.filescan.io/uploads/6446935f1ef9122678a31bac/reports/2a4f5257-caea-4853-9b23-70a0520f8b6b/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/97f12b24e5ae9141902e74706e7b1715a40e172bfd1eafab7271fb584b3b9796
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bdb4640c-dace-4a28-b7e7-904e8fb26528
Result
Threat name:
Fabookie
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1220151
Signature
Antivirus detection for URL or domain
Found stalling execution ending in API Sleep call
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Fabookie
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97f12b24e5ae9141902e74706e7b1715a40e172bfd1eafab7271fb584b3b9796/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-04-24 14:34:12 UTC
File Type:
PE+ (Exe)
Extracted files:
187
AV detection:
9 of 23 (39.13%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s7yswjhfv2iudebooryg46yxcwsa4fzl7upk7k3soh5vqsz3s6la._file
Verdict:
malicious
Similar samples:
0177e5347dc981c4a60f0aa5a609a104d0dd6b9bac0b40071e6aa50f5dd45b54
Fabookie
0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12
Fabookie
0dde54786dfb33eb21bceba95d017977c7647a553ef91b1fa1dd7742198b6206
Fabookie
48816852a5c4f04278a0073986fe3bfd965baac4c686e47a46de64b3d956e3f5
Fabookie
647afe227b07e0b2eee651cf8273b18a225a306c1bfc46119de5d1f6459db409
Fabookie
7bc25b805c7fb261c4ec8ddf78d398e6bbac2f0e066b2469c508b431f44f233e
Fabookie
7e6ba21c2fb7f3f4a422504154c7be3e72380d8770d69fb25eb3a547a6d2ac7e
Fabookie
902387aa87934a342776e8e81b67323957cb9c1d10288567ca8058a4614a30b0
Fabookie
dfafc19065140674c7b3e3ffe533f121fe6b2fe1ffb9c0a2dfc15a9d030a0630
Fabookie
+ 107 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230424-rxgrbaeb3z/
Behaviour
Modifies system certificate store
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
97f12b24e5ae9141902e74706e7b1715a40e172bfd1eafab7271fb584b3b9796
MD5 hash:
b1a9b9c119b15ff10463fb24ce083d00
SHA1 hash:
26d393625e7f649717b6e6593bdf37a3a2aecae0
Link:
https://www.unpac.me/results/262554b7-77ff-42c6-b1ee-8197e2b1d915/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/97f12b24e5ae9141902e74706e7b1715a40e172bfd1eafab7271fb584b3b9796

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fabookie

Executable exe 97f12b24e5ae9141902e74706e7b1715a40e172bfd1eafab7271fb584b3b9796

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2594534/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/384584/

Comments