MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac63aee7353b19a3e418907615558481661549f6c892c3b798940b814a064d66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Fabookie

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments 1

SHA256 hash:	ac63aee7353b19a3e418907615558481661549f6c892c3b798940b814a064d66
SHA3-384 hash:	c83d5bc97f5d4f326d33a63778e33bf6560e488254d223ff6fd6493f5b4f54c4b7c3a471b3f89727b6b84bed2a18c199
SHA1 hash:	3056bded3667f9f1677f4c9c63c591ed3209f9d3
MD5 hash:	966722db7d8eaee5b5b8b17dfed90d8f
humanhash:	delta-hotel-twelve-triple
File name:	966722db7d8eaee5b5b8b17dfed90d8f
Download:	download sample
Signature	Fabookie Create hunting rule
File size:	3'662'336 bytes
First seen:	2022-05-19 13:52:00 UTC
Last seen:	2022-05-19 15:07:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	bb46f1abb2c1ede95f964a725f9d1284 (123 x Fabookie)
ssdeep	49152:fpynoZZGXahMy/ChMQC3pJDJ4xdrOoLFEIbZ6YooogWNeLxd5yR1K5w+KnP6SObU:zZ7vqDwDArHLiIbsfCWNgx3yFhnBO+
Threatray	97 similar samples on MalwareBazaar
TLSH	T1830612AD6244331CC41E81B45A33BE4AB2F6D62E1ED598BA71C73B80B7E7455EA01F07
TrID	45.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.3% (.EXE) OS/2 Executable (generic) (2029/13) 18.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter	zbetcheckin
Tags:	exe Fabookie

Intelligence

File Origin

# of uploads :

# of downloads :

277

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/272586/

Detection(s):

SecuriteInfo.com.Suspicious.Win32.Save.a.7520.21824.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Sending an HTTP GET request

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/18970/overview

Behaviour

MalwareBazaar

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62864ba458b48b2dbfe28987/reports/6daffc9a-bda1-4bb2-b7d9-2a2eea840962/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b1b30352-1bd5-47e3-8964-ad5eebb45baa

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/997724

Signature

Detected VMProtect packer

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Tries to detect virtualization through RDTSC time measurements

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ac63aee7353b19a3e418907615558481661549f6c892c3b798940b814a064d66/

Threat name:

Win64.Trojan.Phonzy

Status:

Malicious

First seen:

2022-05-19 13:52:17 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

19 of 26 (73.08%)

Threat level:

5/5

Verdict:

suspicious

Result

Malware family:

n/a

Score:

8/10

Tags:

vmprotect

Link:

https://tria.ge/reports/220519-q6dkksbaeq/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

Looks up external IP address via web service

VMProtect packed file

Unpacked files

SH256 hash:

ac63aee7353b19a3e418907615558481661549f6c892c3b798940b814a064d66

MD5 hash:

966722db7d8eaee5b5b8b17dfed90d8f

SHA1 hash:

3056bded3667f9f1677f4c9c63c591ed3209f9d3

Link:

https://www.unpac.me/results/a56dba56-d1d6-4171-b88e-4c224fc3e0ba/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ac63aee7353b19a3e418907615558481661549f6c892c3b798940b814a064d66

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.