Extracted

Extracted

Extracted

Extracted

• • Target

    3aa3919af2e858ed404c963bb19ed248

  • Size

    8.6MB

  • MD5

    3aa3919af2e858ed404c963bb19ed248

  • SHA1

    f7751ed5bbbbf0805cb97f1b0f8736d531741ad9

  • SHA256

    b5f88e34db4bb65da8c21982590b67922fe32e62e7cfaae9fbe417a4262aa143

  • SHA512

    a80d6c09b9afae8141d6df82e4b60cdffc94f251af93a934abe55ae78ac1b38be8410b31e941f8423480d90735a0962c6fbccc7fcecae210392606291ec3b7dc

  • SSDEEP

    196608:UdE5aRW4cuxHd/Q51nOAlfkvXhseFMYUOx4ELSLe:aE5anz/QuAlq6DVM8e

  Score

  10^/10

  fabookieffdroiderprivateloaderriseprosmokeloadersocelarspub2backdoorevasionloaderpersistencespywarestealertrojanupxvmprotect

  • Detect Fabookie payload

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider

  • FFDroider payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • Modifies boot configuration data using bcdedit

  • Nirsoft

  • Modifies Windows Firewall

    evasion

  • Possible attempt to disable PatchGuard

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2