MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cfe0a73fbe0198ed123b0e909b7c8aeda2a2ce41925455ab98184e69d13aab0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fabookie


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cfe0a73fbe0198ed123b0e909b7c8aeda2a2ce41925455ab98184e69d13aab0
SHA3-384 hash: 6b46d56b85ecf72edad36f003127652c05733bf50c9ce42b6cbef57fe4de815002341a3208549180cfe6094a70488883
SHA1 hash: 6488d5020f7276f1abb851e35df3a2b12e7619e7
MD5 hash: 99081d9d86392ddc80eb2a16c4103ab5
humanhash: nebraska-kitten-bulldog-solar
File name:99081d9d86392ddc80eb2a16c4103ab5.exe
Download: download sample
Signature Fabookie
Create hunting rule
File size:3'650'560 bytes
First seen:2023-01-17 14:33:46 UTC
Last seen:2023-01-17 16:35:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ad0f1494dc86ecee248683e56cf46eb2 (10 x Fabookie)
ssdeep 49152:036OmYjoHW7RQxKdU8xf75vmZ8t06EYEWpOejQopR0iLjrf9X9sK0Ex7yGhx66tb:0qA8HjKdvxf7qS0ZPkDLJMK0E9ji8
Threatray 9 similar samples on MalwareBazaar
TLSH T11FF502FDA2483398C01A89309133FD55B1B6151E1AF985FEB9DBBAC07FAF5209611F06
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:exe Fabookie

Intelligence

File Origin
# of uploads :
2
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
99081d9d86392ddc80eb2a16c4103ab5.exe
Verdict:
No threats detected
Analysis date:
2023-01-17 14:34:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dc182910-fd05-45ea-868f-27285a0d94ac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/353835/
Detection(s):
SecuriteInfo.com.Win64.Evo-gen.9001.4684.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63c6b1df0089af3e437f8ad5/reports/9c4b4ba3-9b41-490e-b169-afec362100bf/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/c0afcac2-681a-4f12-976f-7830c91109bf
Result
Threat name:
Fabookie
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1153270
Signature
Detected VMProtect packer
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Fabookie
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cfe0a73fbe0198ed123b0e909b7c8aeda2a2ce41925455ab98184e69d13aab0/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-01-17 14:34:15 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
18 of 25 (72.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tt7au4734amy5ujdwduqtn6iv3nculhedesukwvzqgconhitvkya._file
Verdict:
unknown
Similar samples:
1b67efa690ee66657a7d2a1e7438bdf7e74e64f4fdfa85e4aefceed1e0e1040d
Fabookie
371aab310f82dd4f64f09981c1d3d8974f18227c98679af43bd0559ec6752dde
Fabookie
40995019652863343f9ad35ce8f3519e84526fd8013fb85e48cc11675e2fb567
Fabookie
47700e0d714e9888a6590932c590cb5a419d71be8627f7b36c83be99ce709feb
Fabookie
7817140444513a63eac95e20b139b61c3e10a5bc0371216ca87c56c700d6c2e6
Fabookie
9808d6a6b9ae7baef6715e6440988055682a88d1b5b1096148acdddc371ecfd2
Fabookie
ae8ed0840c29fa1d5b68c68b2b4aa007b9a92095356c35cdd702756fed845844
Fabookie
cc65124164f81d4c678d7b4d4bb7a1f9fb09bfbd5da3ff6e481f07fa9bcac023
Fabookie
Result
Malware family:
n/a
Score:
  8/10
Tags:
vmprotect
Link:
https://tria.ge/reports/230117-rxe8gsdf2v/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
VMProtect packed file
Unpacked files
SH256 hash:
9cfe0a73fbe0198ed123b0e909b7c8aeda2a2ce41925455ab98184e69d13aab0
MD5 hash:
99081d9d86392ddc80eb2a16c4103ab5
SHA1 hash:
6488d5020f7276f1abb851e35df3a2b12e7619e7
Link:
https://www.unpac.me/results/a467b727-52be-4e28-a0e0-b3b1ea96a833/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9cfe0a73fbe0198ed123b0e909b7c8aeda2a2ce41925455ab98184e69d13aab0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fabookie

Executable exe 9cfe0a73fbe0198ed123b0e909b7c8aeda2a2ce41925455ab98184e69d13aab0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2449245/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/353835/

Comments