MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c147ca8f1016219cde5af033a793a309dd7341c9f9f9c66e0241bd978cf7c5f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fabookie


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c147ca8f1016219cde5af033a793a309dd7341c9f9f9c66e0241bd978cf7c5f6
SHA3-384 hash: 5b374dc6d4f77af09b9de0fabc6ecdfea7a827f1e6f0c84e454e1e1754b10bc9c57aa5f2ede9851a420e808fbaf8ac21
SHA1 hash: 30d94a961d70cb65eaaf19fdbff60d99e6eb1306
MD5 hash: 46347616e475cf03de5bd70639d6620d
humanhash: leopard-tango-missouri-carolina
File name:46347616e475cf03de5bd70639d6620d
Download: download sample
Signature Fabookie
Create hunting rule
File size:3'923'968 bytes
First seen:2022-07-23 04:25:53 UTC
Last seen:2022-07-23 04:48:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash bb46f1abb2c1ede95f964a725f9d1284 (123 x Fabookie)
ssdeep 98304:Kgv6VxN2zMz2qmlvgcB9x67koiGhMCm9S18x4u:zv6/sYivg0xRoiExm9UZ
Threatray 145 similar samples on MalwareBazaar
TLSH T1A60612BE62447368C41AC9349537BD06F2B9121E1FE8D9BE72CB76C07BBB4109606F46
TrID 45.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.3% (.EXE) OS/2 Executable (generic) (2029/13)
18.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter openctibr
Tags:exe Fabookie OpenCTI.BR Sandboxed

Intelligence

File Origin
# of uploads :
2
# of downloads :
294
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/293583/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.39999007.19620.16158.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62db78de7b83f958a96d15be/reports/8dff7f57-ecf3-4bdc-b2ad-93ef26f09f98/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/35d9626b-3c8a-4c23-a1a8-60c1c8448893
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1039621
Signature
Antivirus detection for URL or domain
Detected VMProtect packer
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c147ca8f1016219cde5af033a793a309dd7341c9f9f9c66e0241bd978cf7c5f6/
Threat name:
Win64.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2022-07-15 09:33:03 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
26 of 41 (63.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yfd4vdyqcyqzzxs26az2pe5dbhoxgqoj7h44m3qcig6zpdhxyx3a._file
Verdict:
malicious
Similar samples:
0aa099daec28b9cbae305db0255f215c846223fc00428c360d190a42660fe6f5
Fabookie
2e03ef43f89ca8797a85244c2892fc0b5d5de7e73f0eacac51ccf1ab370f0bf5
Fabookie
6069f751561f8bff19fac17bccfb6e9c6a22f0443b4c56742c6a75b3325c4de1
Fabookie
781fbd6477a586df6a37d3bb49576db5804f831a730b90dbb5eb13d6f04a16c6
Fabookie
9027ccb4744f40d99a8394a52f2a0f4e88ce44719b053c8d5d041d57b352bcaa
Fabookie
b03a446c358a18fc9224a3db40ab1da280e43e564105055b3dbb29b44f2b7fea
Fabookie
c2e5b2b63b351d8e85d88f5a2a326d53113cdb10776942343c34c22e7fc04d8a
Fabookie
c6b7fe27e084fcc8c649fa176f3492b55f8c31362063058e87ed53d54f046f01
Fabookie
e413704f93843d2ee0cbc181ff750a17c73180635c003eed156c9b13fd28f351
Fabookie
e737048deb3ca3d547b7ba94d7b0dc5eba03f7a05ec9c9fbef2d5a3f0fc20882
Fabookie
+ 135 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
vmprotect
Link:
https://tria.ge/reports/220723-e2hsysccbj/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
VMProtect packed file
Unpacked files
SH256 hash:
c147ca8f1016219cde5af033a793a309dd7341c9f9f9c66e0241bd978cf7c5f6
MD5 hash:
46347616e475cf03de5bd70639d6620d
SHA1 hash:
30d94a961d70cb65eaaf19fdbff60d99e6eb1306
Link:
https://www.unpac.me/results/28572f96-3cfe-4269-b5a7-0458a1d0c77a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.08
Link:
https://yomi.yoroi.company/submissions/c147ca8f1016219cde5af033a793a309dd7341c9f9f9c66e0241bd978cf7c5f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fabookie

Executable exe c147ca8f1016219cde5af033a793a309dd7341c9f9f9c66e0241bd978cf7c5f6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2202464/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/293583/

Comments