fabookie

General

Target

0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cdN.exe
Size

5.6MB
Sample

241124-yn88jasnck
MD5

a121db3e0809289a5c41c44958ff6fa0
SHA1

fd40bbe6eaeea4004046f65a8c647fabb35e1742
SHA256

0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd
SHA512

0e4af224ea67c07bdce0bae3b4040d900e2c011557ef55d8d0e68d596826561a8d4f3b553cc3290cf60e87ccee975deb65c1de9553fabfee5f67268935d8081f
SSDEEP

98304:JVw5AxSbnFouWDC50KmHeIQT8ZVK+zoN3aZdKfFEqsJtn05C5H+ZB3pjHOR:Ja5AeFeC5UH5a87/oN3aZdKNyxeCH+ZY

Malware Config

Extracted

Family

nullmixer

C2

http://hsiens.xyz/

Extracted

Family

privateloader

C2

http://45.133.1.107/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

51.178.186.149

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.znsjis.top/

Extracted

Family

redline

Botnet

she

C2

135.181.129.119:4805

Attributes

auth_value
b69102cdbd4afe2d3159f88fb6dac731

Extracted

Family

redline

Botnet

ANI

C2

194.104.136.5:46013

Attributes

auth_value
9491a1c5e11eb6097e68a4fa8627fda8

Extracted

Family

gcleaner

C2

ppp-gl.biz

45.9.20.13

Targets

- Target
  
  0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cdN.exe
- Size
  
  5.6MB
- MD5
  
  a121db3e0809289a5c41c44958ff6fa0
- SHA1
  
  fd40bbe6eaeea4004046f65a8c647fabb35e1742
- SHA256
  
  0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd
- SHA512
  
  0e4af224ea67c07bdce0bae3b4040d900e2c011557ef55d8d0e68d596826561a8d4f3b553cc3290cf60e87ccee975deb65c1de9553fabfee5f67268935d8081f
- SSDEEP
  
  98304:JVw5AxSbnFouWDC50KmHeIQT8ZVK+zoN3aZdKfFEqsJtn05C5H+ZB3pjHOR:Ja5AeFeC5UH5a87/oN3aZdKNyxeCH+ZY
Score

10^/10

fabookie gcleaner nullmixer onlylogger privateloader redline sectoprat socelars ani she aspackv2 discovery dropper execution infostealer loader rat spyware stealer trojan
- Detect Fabookie payload
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- Fabookie family
  fabookie
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Gcleaner family
  gcleaner
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- Nullmixer family
  nullmixer
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Onlylogger family
  onlylogger
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Privateloader family
  privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Sectoprat family
  sectoprat
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars family
  socelars
- Socelars payload
- OnlyLogger payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  setup_installer.exe
- Size
  
  5.5MB
- MD5
  
  8f86dedab3baf5ffaaebb8a77d417737
- SHA1
  
  2469e1057b3a544402d57a602a916b0663a8ff8c
- SHA256
  
  b25679ef641f0a807ef8200eb0ec464680dfdfff23b42bad85099b140c5d5630
- SHA512
  
  2f70caeb89da15a3b1222b52cf49b09af61937b1bf92b5c0baad4d222a9c02f30e174cc9bd8078531fac26213fb990ab1cac78b13f38e7cbc75389685b0ec61c
- SSDEEP
  
  98304:xHJbto7+irOuqh3GOt0vgYklZpKnKjHKUeFeK0szczORFoUBcWQ:xHjoNF6GOtUklzjqUeYY9RFoUmf
Score

10^/10

fabookie gcleaner nullmixer onlylogger privateloader redline sectoprat socelars ani she aspackv2 discovery dropper execution infostealer loader rat spyware stealer trojan
- Detect Fabookie payload
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- Fabookie family
  fabookie
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Gcleaner family
  gcleaner
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- Nullmixer family
  nullmixer
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Onlylogger family
  onlylogger
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Privateloader family
  privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Sectoprat family
  sectoprat
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars family
  socelars
- Socelars payload
- OnlyLogger payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral3 behavioral4