fabookie | ee29566cfa074ad9bd7b9450de0d43738a85322ef2d7aede79c8ea684ae65357

Analysis

max time kernel
122s
max time network
126s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
31/08/2023, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ee29566cfa074ad9bd7b9450de0d43738a85322ef2d7aede79c8ea684ae65357.exe
Size

320KB
MD5

1efdd8ff2bea02d6ef2fb16b2a3dc7fe
SHA1

f951489e19aeed24006bafced93d3c9fd234e21e
SHA256

ee29566cfa074ad9bd7b9450de0d43738a85322ef2d7aede79c8ea684ae65357
SHA512

8d3110cf6518da2b1090a942bbd562d43b41271346a2c895698713014c8119aadd3f58cd4208d2048037749096d9d7df5b7c41d566ec5a77d806375963ed9ca8
SSDEEP

6144:q/ji2H5hOorWFoWdN46Ja6VWxtoloBj5rbx:qbOoyNdN9J/VJ6Bj5rbx

Score

10^/10

fabookie spyware stealer

Malware Config

Signatures

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral1/memory/5116-12-0x0000000002DC0000-0x0000000002EF1000-memory.dmp	family_fabookie
behavioral1/memory/5116-15-0x0000000002DC0000-0x0000000002EF1000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

C:\Users\Admin\AppData\Local\Temp\ee29566cfa074ad9bd7b9450de0d43738a85322ef2d7aede79c8ea684ae65357.exe
"C:\Users\Admin\AppData\Local\Temp\ee29566cfa074ad9bd7b9450de0d43738a85322ef2d7aede79c8ea684ae65357.exe"
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5116-0-0x00007FF641020000-0x00007FF641075000-memory.dmp

Filesize
340KB

Download
memory/5116-11-0x0000000002C40000-0x0000000002DB1000-memory.dmp

Filesize
1.4MB

Download
memory/5116-12-0x0000000002DC0000-0x0000000002EF1000-memory.dmp

Filesize
1.2MB

Download
memory/5116-15-0x0000000002DC0000-0x0000000002EF1000-memory.dmp

Filesize
1.2MB

Download