fabookie

General

Target

Ransom;Win32.StopCrypt.MIK!MTB.ZIP
Size

9.0MB
Sample

240609-n5ys1sac5z
MD5

0a55cbabc399e9f00a7a1f9cd7de9512
SHA1

41d844261650b101127cda19503729794523a1a7
SHA256

2e7af049da3dad90280bfc5fcb78c574199ba948ed2d0b33bf32c15199e04d73
SHA512

e987dfa0004a24b8fc566925315320561108d5716c139e57c59e3914226045a008d53abdb9a44f28593e17508bda78f5aa2f1f47a2cacf8666483c825cfe5fa2
SSDEEP

196608:+nWPwWc5/7WOoLKp8XCy77nL18DjReaJ9kTpcyTT/9U:gWPQ0ZLO4LSRr9ktcyTT/i

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.znsjis.top/

Extracted

Family

privateloader

C2

http://45.133.1.182/proxies.txt

http://45.133.1.107/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

51.178.186.149

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Extracted

Family

ffdroider

C2

http://186.2.171.3

Targets

- Target
  
  Ransom;Win32.StopCrypt.MIK!MTB.exe
- Size
  
  9.1MB
- MD5
  
  93e23e5bed552c0500856641d19729a8
- SHA1
  
  7e14cdf808dcd21d766a4054935c87c89c037445
- SHA256
  
  e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555
- SHA512
  
  3996d6144bd7dab401df7f95d4623ba91502619446d7c877c2ecb601f23433c9447168e959a90458e0fae3d9d39a03c25642f611dbc3114917cad48aca2594ff
- SSDEEP
  
  196608:PBXWySxHnUIYfGp0N6k7jn3R655p0aRnk6bAEzV1d:pXc6rf6Q3ipdnkqAEzVf
Score

10^/10

fabookie ffdroider privateloader redline sectoprat socelars udp evasion infostealer loader rat spyware stealer trojan
- Detect Fabookie payload
- FFDroider
  Stealer targeting social media platform users first seen in April 2022.
  stealer ffdroider
- FFDroider payload
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Modifies Windows Firewall
  evasion
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
behavioral1