MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe51caf5491e7f38b524ed374c6c9701700a9fa9c8f950379424fae99de0ced2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fe51caf5491e7f38b524ed374c6c9701700a9fa9c8f950379424fae99de0ced2
SHA3-384 hash:	c9c6a11e29a46c10fdf9195914af95a6460961fc449617079cf9286736d2d275aa5cfbda6ae98250ee0c427ef1577c15
SHA1 hash:	4962bb865b30ab03e4951279aaee6f1a9fdb569d
MD5 hash:	f425b51dc0e1587c5901c511cabbddd2
humanhash:	magnesium-yellow-bravo-seven
File name:	f425b51dc0e1587c5901c511cabbddd2.exe
Download:	download sample
Signature	Fabookie Alert Create hunting rule
File size:	431'104 bytes
First seen:	2023-06-21 07:06:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d1884757532ce7b0014241f40262c929 (16 x Fabookie)
ssdeep	6144:ul073J3gQx1K46tV9rSDWso3T+cbJ5JIJAbW0we3:z3JwQHKjT25oCIJ5MZ0w
TLSH	T16F949EE1E34040E5D477C2B982774B62E7F27C285B214ADF4659B7292F337D28936A0B
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10523/12/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	70646666fab4b064 (18 x Fabookie, 5 x GuLoader)
Reporter	abuse_ch
Tags:	exe Fabookie

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

273

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

f425b51dc0e1587c5901c511cabbddd2.exe

Verdict:

Malicious activity

Analysis date:

2023-06-21 07:09:18 UTC

Tags:

fabookie

Link:

https://app.any.run/tasks/3315cace-8631-48fd-98cf-a3b6df2a1ca6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/401256/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win64.Trojan-gen.17890.6940.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Searching for the window

Sending a custom TCP request

Query of malicious DNS domain

Launching a tool to kill processes

Sending an HTTP GET request to an infection source

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

lolbin shell32.dll

Link:

https://www.filescan.io/uploads/6492a19999f0c0cb0933276a/reports/871e8ae1-00e4-426d-a3d5-fb0fea0b5b18/overview

Hybrid Analysis Generik.IVDXFSG trojan

Verdict:

Malicious

Labled as:

Generik.IVDXFSG trojan

Link:

https://www.hybrid-analysis.com/sample/fe51caf5491e7f38b524ed374c6c9701700a9fa9c8f950379424fae99de0ced2

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/63ef6706-a289-4253-8f44-5048d20952ae

Joe Sandbox Fabookie

Result

Threat name:

Fabookie

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1258837

Signature

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Fabookie

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fe51caf5491e7f38b524ed374c6c9701700a9fa9c8f950379424fae99de0ced2/

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-06-20 19:48:06 UTC

File Type:

PE+ (Exe)

Extracted files:

50

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7zi4v5kjdz7trnje5u3uy3exafyavh5jzd4van4uet5othpaz3ja._file

Threatray suspicious

Verdict:

suspicious

Hatching Triage fabookie

Result

Malware family:

fabookie

Alert

Create hunting rule

Score:

  10/10

Tags:

family:fabookie spyware stealer

Link:

https://tria.ge/reports/230621-hxneeshc6s/

Behaviour

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Reads user/profile data of web browsers

Detect Fabookie payload

Fabookie

UnpacMe

Unpacked files

SH256 hash:

fe51caf5491e7f38b524ed374c6c9701700a9fa9c8f950379424fae99de0ced2

MD5 hash:

f425b51dc0e1587c5901c511cabbddd2

SHA1 hash:

4962bb865b30ab03e4951279aaee6f1a9fdb569d

Link:

https://www.unpac.me/results/556d78f5-dea7-434f-823a-07c376d42b7a/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fe51caf5491e7f38b524ed374c6c9701700a9fa9c8f950379424fae99de0ced2

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fabookie

exe fe51caf5491e7f38b524ed374c6c9701700a9fa9c8f950379424fae99de0ced2

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2642466/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/401256/