Overview

overview

10

Static

static

3

7f65a6c398...41.exe

windows7-x64

10

7f65a6c398...41.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f65a6c3980e34e815a8a74420b12cb88ef2abc58e6b91c2026e96ffe5709d41

  • Size

    344KB

  • Sample

    230928-jlehtahc21

  • MD5

    9c531b11dcdedffb63730d2778c7a48c

  • SHA1

    fd550ef1cbca8760ab23698c65702526ec5f7e18

  • SHA256

    b2743a01a4b47a3a3c32c52817d8ab7916e83e2f392078ba275a4518725eb4c4

  • SHA512

    e134ef962c93bc5325bcb3066d8585309f3127aa67a9d9393d2db1693424713245fdde138661196836d7256049d2f771f284dfe47e1b848967fa6a8db9b46c88

  • SSDEEP

    6144:rGy6RhKyBcjX5BBumK04oqAh0mKCtQZFJUU9EA/LKtqkDSGl+xRmPqK:rGy6RhKyKjpx4ox0mp8/UUjD6+eUK

Score
10/10
fabookiespywarestealer

Malware Config

Extracted

Family

fabookie

C2

http://app.nnnaajjjgc.com/check/safe

Targets

    • Target

      7f65a6c3980e34e815a8a74420b12cb88ef2abc58e6b91c2026e96ffe5709d41

    • Size

      636KB

    • MD5

      916abe7da167424883e61d39dfbe165a

    • SHA1

      e789ebc67fb3de4d9b2bd67edddf36157d2c92aa

    • SHA256

      7f65a6c3980e34e815a8a74420b12cb88ef2abc58e6b91c2026e96ffe5709d41

    • SHA512

      3251d32889a7b0fba76c9a8e1907a0a245c63ebfd35a5669b87c8123972c2ec9e88ecd0a57d1c3a0f4c5abd6337384e2d90238f54320e180015f6243500719b0

    • SSDEEP

      6144:MfIWs1kdFDIZQkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:ubfWtcH5049Duca049Duc1y6

    Score
    10/10
    fabookiespywarestealer

    • Detect Fabookie payload

    • Fabookie

      Fabookie is facebook account info stealer.

      spywarestealerfabookie

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks