Overview

overview

10

Static

static

10

0e096c7c7f...e8.exe

windows7-x64

10

0e096c7c7f...e8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_820eae6104c5aa7150917a53e25fd0be9633bcbb7120ea680967a52467e41249

  • Size

    1.7MB

  • Sample

    241222-dd3yjs1lbl

  • MD5

    6e4586a5064bd13fd5058b93dbca52aa

  • SHA1

    e04e3a81881e36ebe09f27ff1c07a739fc69f278

  • SHA256

    820eae6104c5aa7150917a53e25fd0be9633bcbb7120ea680967a52467e41249

  • SHA512

    2d217a38cbab6df137751a8823edd60687b8ffc3d84a0f3c13a027bd6739b52de2ac23c2f73e4a1481c26a71b085b1c01a70fd14fa45e7ab7893822af0318ece

  • SSDEEP

    49152:X2UGSowazjQaQGmjESgsdkBHr1mUrVZDL:X2UGxwazNdmQFBrrZX

Score
10/10
fabookiediscoveryspywarestealer

Malware Config

Targets

    • Target

      0e096c7c7fdf3b3cb9bd341228c09bc9d92cefd9d9ccf3642d29b1eaa3ae68e8

    • Size

      2.6MB

    • MD5

      c174a91d2dc0d74cd27eb6d867360e18

    • SHA1

      3331c256db6e4a10312be405feb4c65ef52305f4

    • SHA256

      0e096c7c7fdf3b3cb9bd341228c09bc9d92cefd9d9ccf3642d29b1eaa3ae68e8

    • SHA512

      b2f372d562f49f8de3a0a58412f92a0d6589d42ea30dd533ff4507a6df923c45db7c38e686d6e13d9502051a508833b8da699c661999dd221b049961401f87e2

    • SSDEEP

      49152:erEOLD0x5+aJVXfxu3Eosp/qw7RV+uY/SUSI0hozrPQi:h2YJtosp/qw7ybHd/

    Score
    10/10
    fabookiediscoveryspywarestealer

    • Detect Fabookie payload

    • Fabookie

      Fabookie is facebook account info stealer.

      spywarestealerfabookie

    • Fabookie family

      fabookie

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks