MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab985e1fa44f52ab1d3c776bfc2343af6660480af1fac4d1eb5a4503b7ac0176. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fabookie


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab985e1fa44f52ab1d3c776bfc2343af6660480af1fac4d1eb5a4503b7ac0176
SHA3-384 hash: ed77ba7ebf5b78347d8cac5cad62c5786f24a0189e324ec458670aab206a1ae5f6d2b0290428b09acfcdc8a8fcafc1a1
SHA1 hash: 7ee541e838678d7088f559acc3284af2ef9f21d3
MD5 hash: a6db8d26d0cba540ab3cf8806048c55a
humanhash: hydrogen-autumn-harry-nine
File name:a6db8d26d0cba540ab3cf8806048c55a.exe
Download: download sample
Signature Fabookie
Create hunting rule
File size:430'080 bytes
First seen:2023-08-28 09:35:23 UTC
Last seen:2023-08-28 10:39:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d1884757532ce7b0014241f40262c929 (16 x Fabookie)
ssdeep 6144:ul073J3gYxsK4ibO9rADWC4t0+eoJAbB3T+cbJp:z3JwYiKdqEs0+5cCIJp
Threatray 466 similar samples on MalwareBazaar
TLSH T1F4949ED2E25040E5D477C2B982734B62E7F27C285F214ADF4659B6292F337D28936A0B
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 70646666fab4b064 (18 x Fabookie, 5 x GuLoader)
Reporter abuse_ch
Tags:exe Fabookie

Intelligence

File Origin
# of uploads :
2
# of downloads :
264
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
https://offersprize.com/wp-content/uploads/File_pass1234.7z
Verdict:
Malicious activity
Analysis date:
2023-08-27 16:19:34 UTC
Tags:
privateloader evasion opendir loader risepro stealer redline fabookie stealc amadey trojan kelihos tofsee miner smoke g0njxa
Link:
https://app.any.run/tasks/6a0ac9b9-2c83-496d-b85a-7a28bb320f15

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/444883/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader45.60187.31075.11104.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending an HTTP GET request
DNS request
Query of malicious DNS domain
Sending a TCP request to an infection source
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
keylogger lolbin shell32 swrort
Link:
https://www.filescan.io/uploads/64ec6a827444d2eb09f27f7b/reports/376506b7-38e0-4574-baf1-89eb340da5a6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ab985e1fa44f52ab1d3c776bfc2343af6660480af1fac4d1eb5a4503b7ac0176
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/976979e2-b0f1-49a0-b62a-c6e6f9013604
Result
Threat name:
Fabookie
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1298597
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contains functionality to steal Chrome passwords or cookies
Detected unpacking (creates a PE file in dynamic memory)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Fabookie
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab985e1fa44f52ab1d3c776bfc2343af6660480af1fac4d1eb5a4503b7ac0176/
Threat name:
Win64.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-08-27 11:58:40 UTC
File Type:
PE+ (Exe)
Extracted files:
50
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vomf4h5ej5jkwhj4o5v7yi2dv5tgasak6h5mjuplljcqhn5maf3a._file
Verdict:
malicious
Similar samples:
083894b5678423ea7077393450f4f9b99809975b9327341481ed0e3330e43154
Fabookie
4a8b6a3e837ed8d977973cc385a5cda8ef78157994323d152e157eea714d05ad
Fabookie
645168fedeed9948b5103f10d52c9adf1133358e1b1ab4ac0893dd3bb73b2df5
Fabookie
7c153ecb0cc0b6c1c4d3033c806bee89285db6e37902df15ebc4c85b46f24338
Fabookie
ac4620769b15f5a7ccbeda9891ab788e46fe418e8129b2d54a64452467ac9eb0
Fabookie
adeeb5ab4974433126bf0c2d15234dc13fcd577217babbf0d352517ec588b7af
Fabookie
d440158b91d965693007b539131704b3bdd72e864b5adc1c0e230213acd3d97b
Fabookie
ee1e789a40e3cc8ff607726cbe0a8b72b86a51e933787a7074ac6c0b58bc59c7
Fabookie
fec5e8cb13f8418df2d3c2188c40eb2844084b02bdd9f2a899690b3a7b25986c
Fabookie
+ 456 additional samples on MalwareBazaar
Result
Malware family:
fabookie
Create hunting rule
Score:
  10/10
Tags:
family:fabookie spyware stealer
Link:
https://tria.ge/reports/230828-lkw3kscf3x/
Behaviour
Modifies system certificate store
Reads user/profile data of web browsers
Detect Fabookie payload
Fabookie
Unpacked files
SH256 hash:
ab985e1fa44f52ab1d3c776bfc2343af6660480af1fac4d1eb5a4503b7ac0176
MD5 hash:
a6db8d26d0cba540ab3cf8806048c55a
SHA1 hash:
7ee541e838678d7088f559acc3284af2ef9f21d3
Link:
https://www.unpac.me/results/52c5a2cc-7d40-426c-890d-9625d9b4c6ea/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ab985e1fa44f52ab1d3c776bfc2343af6660480af1fac4d1eb5a4503b7ac0176

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fabookie

Executable exe ab985e1fa44f52ab1d3c776bfc2343af6660480af1fac4d1eb5a4503b7ac0176

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2706324/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/444883/

Comments