fabookie

General

Target

Game_v1.zip
Size

33.3MB
Sample

230223-q4zd9sga47
MD5

0a1e3afb1d0ce361d94ce8f7171ad2ec
SHA1

4a79902a65c3176b119ce4d8eca604cb6d215598
SHA256

903695cd1159287e54051d2d8666618c5c7fa366e386e4d0896ff142a985d826
SHA512

633f499ffdbed59d3814d54eaf2f0de21a0e7f97d2844508aea2f62a26e5652760abfe2cea13d6d864e1b3ea6737892bc735177215b771b0413490966a51cec3
SSDEEP

786432:4G0h/kn5dsemO6UdomOc7QigzpcL//nSi37x2Qdqd:4GK/k5dsemOTQpcL//nX37O

Score

10^/10

Malware Config

Targets

- Target
  
  Game.exe
- Size
  
  5.4MB
- MD5
  
  2694829cbbbbae11c9739c44487fd7ad
- SHA1
  
  2af3e59940159d5bc37e75cb4060d677f3900799
- SHA256
  
  7c8394def968d283d507cbd4f23ca5d2cf348ffcbf5f72fa8262bca22852e104
- SHA512
  
  06102826af24db8556a0133a66da40da7853457413e334bc01fcd480413a96d3ca0d8273d766829b43c28dc380b3d53ff0528065402b077328736ec48d7067a0
- SSDEEP
  
  98304:NgggDCyOjwQrI5IaofNLCI4cMCU+lVIbNejBQWTW0efUVROTu9A2ez212d:elOyWNU9IUCZXqcuWTcfUV4a9leCi
Score

10^/10

fabookie pseudomanuscrypt xmrig evasion loader miner spyware stealer upx vmprotect
- Detect Fabookie payload
- Detects PseudoManuscrypt payload
  loader
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- Modifies security service
  evasion
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- PseudoManuscrypt
  PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
  loader pseudomanuscrypt
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Drops file in Drivers directory
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2