fabookie

General

Target

03765cd4acad61f85cb2237a6f6f9b8dd98774aa492c8439a2343d14b5c7d01e
Size

6MB
Sample

230928-zv99vafh23
MD5

693ddcc7a32e6309f3fed8faf71d058c
SHA1

5e2b63d183edfd56d7aa8b81dff4bfd093e3760a
SHA256

03765cd4acad61f85cb2237a6f6f9b8dd98774aa492c8439a2343d14b5c7d01e
SHA512

23364792a17118952a82ef73c672237bda2523b2bd35617aaebb502d592174039660eb885aa59c2a40b5e3c0b315bd7731597719b78d821817c3993fb0d69c40
SSDEEP

196608:DWeBipf+AgWSmIql5oigGrCWrcUO0NAoGqv8N1uFMx5fBO:XBip0puoivdD5NAoGqv8N1Lx5f

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

fabookie

C2

http://app.nnnaajjjgc.com/check/safe

Targets

- Target
  
  03765cd4acad61f85cb2237a6f6f9b8dd98774aa492c8439a2343d14b5c7d01e
- Size
  
  6MB
- MD5
  
  693ddcc7a32e6309f3fed8faf71d058c
- SHA1
  
  5e2b63d183edfd56d7aa8b81dff4bfd093e3760a
- SHA256
  
  03765cd4acad61f85cb2237a6f6f9b8dd98774aa492c8439a2343d14b5c7d01e
- SHA512
  
  23364792a17118952a82ef73c672237bda2523b2bd35617aaebb502d592174039660eb885aa59c2a40b5e3c0b315bd7731597719b78d821817c3993fb0d69c40
- SSDEEP
  
  196608:DWeBipf+AgWSmIql5oigGrCWrcUO0NAoGqv8N1uFMx5fBO:XBip0puoivdD5NAoGqv8N1Lx5f
Score

10^/10

fabookie glupteba smokeloader up3 backdoor discovery dropper evasion loader spyware stealer trojan
- Detect Fabookie payload
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1