MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcaff58e4efc3c80c7a401686a5e9acbd13d265ace38bef195e7ee6380ffbf23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fabookie


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bcaff58e4efc3c80c7a401686a5e9acbd13d265ace38bef195e7ee6380ffbf23
SHA3-384 hash: 802dd5fb2ca031e3d6556721e6d424fa586ed98c69cadab1a3af2ca3636cafe9b0a2653ed1f36a4cd2bbeaa2e6878e3d
SHA1 hash: 4932d8ea0273d40cb6f0b0e15c685f914be01eb3
MD5 hash: b8ac0b50599377d7f2630c657a55c61f
humanhash: iowa-kansas-cold-burger
File name:file
Download: download sample
Signature Fabookie
Create hunting rule
File size:378'880 bytes
First seen:2023-06-23 19:19:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 99782e0cdc1c7b57cdc2cde5daff70c0 (14 x Fabookie)
ssdeep 6144:iquy9wUep3cisGiKzt8bFaggXWe0CvZEOHHrpm1XUZLxEZEOHHrpm1XUZLx:iR+wUep/v0ChtLpm1EwtLpm1E
Threatray 248 similar samples on MalwareBazaar
TLSH T1B484492DBBA84476E163C57FD9B2D665D77238916F208BCB0212863F0D376D89938732
TrID 31.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
24.5% (.SCR) Windows screen saver (13097/50/3)
19.7% (.EXE) Win64 Executable (generic) (10523/12/4)
9.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon f2e2c2828298d870 (16 x Fabookie, 1 x AsyncRAT, 1 x CoinMiner)
Reporter jstrosch
Tags:exe Fabookie X64

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-06-23 19:22:58 UTC
Tags:
fabookie
Link:
https://app.any.run/tasks/f8368fbe-f367-45d4-a900-52b6212baab2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/402280/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67709905.11502.20550.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Searching for the window
Query of malicious DNS domain
Launching a tool to kill processes
Sending an HTTP GET request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm lolbin packed setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/6495f06676927ec2c0074c45/reports/12dba52f-ef57-4007-b054-f1053ebf4e9d/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/bcaff58e4efc3c80c7a401686a5e9acbd13d265ace38bef195e7ee6380ffbf23
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/248e2d6f-cf49-4ae1-a290-77e50503f6f2
Result
Threat name:
Fabookie
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1260745
Signature
Antivirus detection for URL or domain
Contains functionality to steal Chrome passwords or cookies
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Fabookie
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bcaff58e4efc3c80c7a401686a5e9acbd13d265ace38bef195e7ee6380ffbf23/
Threat name:
Win64.Trojan.Fabookie
Create hunting rule
Status:
Malicious
First seen:
2023-06-23 02:47:07 UTC
File Type:
PE+ (Exe)
Extracted files:
53
AV detection:
13 of 37 (35.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xsx7ldso7q6ibr5eafuguxu2zpit2js2zy4l54mv47xghah7x4rq._file
Verdict:
malicious
Similar samples:
0875f2085b2f40b96db96d317cfdd1d870541182d4200de33fae9cbefaf07797
Fabookie
3995ed61d4b3901bfacb5a8d36500664c1145c6287f8eba5f0077ef1b780355c
Fabookie
51f7cb2bce2460bec286f14978cb796e6858be4335c10401a1fb9e54893cca92
Fabookie
6a484f5151e737797fc523ca6ecbb9dcd201e06beb262880e30c6c4d8c9bfee3
Fabookie
85b2316619510cb5e482c62b27714f9e8f83bdd8d73ea530d29e48bfafb509f7
Fabookie
8dc7d4261b9ea7463ae129a04c13beb905d7a5722b03c90ea57e0a81c04f0880
Fabookie
9d4bf2fa222c2fa818ed73796f639d7138d2065616ee126c38b8145723164a94
Fabookie
a47a44fa64fb011abca6e81d17646153861e56c5f4d5c3f798e5d5399b569b97
Fabookie
a913b2046e7d919cc02f7fe509eb50d674cdf21be7122295fcaf9e5acdcfc3ac
Fabookie
cf4c10732e1ed55669890820b459236dc32f8df82c3246be778a327c0192b349
Fabookie
+ 238 additional samples on MalwareBazaar
Result
Malware family:
fabookie
Create hunting rule
Score:
  10/10
Tags:
family:fabookie spyware stealer
Link:
https://tria.ge/reports/230623-x13qvahg8t/
Behaviour
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Reads user/profile data of web browsers
Detect Fabookie payload
Fabookie
Unpacked files
SH256 hash:
bcaff58e4efc3c80c7a401686a5e9acbd13d265ace38bef195e7ee6380ffbf23
MD5 hash:
b8ac0b50599377d7f2630c657a55c61f
SHA1 hash:
4932d8ea0273d40cb6f0b0e15c685f914be01eb3
Link:
https://www.unpac.me/results/600bf6ac-a9fa-49fc-ac9b-748ffb0049fc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bcaff58e4efc3c80c7a401686a5e9acbd13d265ace38bef195e7ee6380ffbf23

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fabookie

Executable exe bcaff58e4efc3c80c7a401686a5e9acbd13d265ace38bef195e7ee6380ffbf23

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/402280/
  
URLhaus
https://urlhaus.abuse.ch/url/2668222/

Comments