Overview

overview

10

Static

static

3

b6d0b0dd27...3e.exe

windows7-x64

10

b6d0b0dd27...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b6d0b0dd27c5a81ca7a1655975c624025c0961080fd779558071371b14906f3e

  • Size

    344KB

  • Sample

    230928-jll8nahc3s

  • MD5

    a4afdbb0773f59844364f5f1fae97399

  • SHA1

    697aa0b203ec611c6310cd3f5454e8e63cfc7b1e

  • SHA256

    938dfa22ad95b1df50175dc53bdada7ebf9ad4336b0a0213a55343993d8ce578

  • SHA512

    54a1862f1a0702076aab833937f06fb8b5079a97a4214aeb10d55594533fc31e26e9bc67b867e225ceb9792f94dbffd546ffa6a7727fb3d49e19ffb7c1f5670a

  • SSDEEP

    6144:WGy6RhKyBcjX5B3umK04oqAh0mKCtQZFJUU9EA/LKtqkDSGl+xRmPqr:WGy6RhKyKjpj4ox0mp8/UUjD6+eUr

Score
10/10
fabookiespywarestealer

Malware Config

Extracted

Family

fabookie

C2

http://app.nnnaajjjgc.com/check/safe

Targets

    • Target

      b6d0b0dd27c5a81ca7a1655975c624025c0961080fd779558071371b14906f3e

    • Size

      636KB

    • MD5

      ee986ee5678d75f306df179bc703912d

    • SHA1

      84cedd4a3438a5600c3c8790a050fb0234170530

    • SHA256

      b6d0b0dd27c5a81ca7a1655975c624025c0961080fd779558071371b14906f3e

    • SHA512

      bfec47ee343b614e0e675f923a13765d5cdda63a07be4e9999354ade2e8e5327218c04190916d86582b614fc7e4ea88a7fab595850c697c710e47400100e5190

    • SSDEEP

      6144:MfIWs1kdFDIZ4kzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:ubfetcH5049Duca049Duc1y6

    Score
    10/10
    fabookiespywarestealer

    • Detect Fabookie payload

    • Fabookie

      Fabookie is facebook account info stealer.

      spywarestealerfabookie

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks