Essential information

Value / Name

9ae642c8d62773a8c69e4144a99f409458038aeb

Confidence

100/100

Revoked

Yes

Valid from

28/03/2023 21:08

Valid until

30/06/2024 21:08

Pattern type

yara

Published

20/12/2025 19:38

Modified

20/12/2025 23:42

Author / Source

AlienVault

Description

No description.

Pattern

rule fabookie_stealer {   
       meta:   
           author = "@luc4m"   
           date = "2023-03-26"   
           link = "https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1"   
           hash_md5 = "901ce391f5d25a12282e7ff436a5e62a"   
           tlp = "WHITE"   
       strings:   
           $trait_0 = {48 89 5c 24 ?? 48 89 74 24 ?? 57 48 83 ec 20 49 8b f8 8b da 48 8b f1 83 fa 01 75 05}   
           $trait_1 = {48 89 48 ?? 48 8b 41 ?? 49 89 41 ?? 48 8b 07 48 3b 48 ?? 75 06}   
           $trait_2 = {4c 89 48 ?? 49 89 09 4c 89 49 ?? 48 8b 42 ?? 40 38 70 ?? 0f 84 3b fe ff ff}   
           $trait_3 = {49 8b 42 ?? c6 40 ?? ?? 48 8b 5c 24 ?? 49 8b c0 48 8b 74 24 ?? 48 8b 7c 24 ?? c3}   
           $trait_4 = {83 67 ?? ?? 48 8b 5c 24 ?? 48 c7 47 ?? ?? ?? ?? ?? c6 07 00 48 83 c4 20 5f c3}   
           $trait_5 = {83 67 ?? ?? 48 8b 5c 24 ?? 48 c7 47 ?? ?? ?? ?? ?? c6 07 00 48 83 c4 20 5f c3}   
           $trait_6 = {4c 8b 41 ?? 48 83 c2 27 49 2b c8 48 8d 41 ?? 48 83 f8 1f 77 44}   
           $trait_7 = {18 e8 be e0 00 00 48 8b 4b ?? e8 a5 5d 04 00 48 8d 05 ?? ?? ?? ?? 48 89 03 40 f6 c7 01 74 0d}   
           $trait_8 = {ba 30 00 00 00 48 8b cb e8 98 e0 00 00 48 8b c3 48 8b 5c 24 ?? 48 83 c4 20 5f c3}   
           $trait_9 = {4d 30 e8 65 4f f8 ff 90 ?? ?? ?? ?? 39 70 ?? 72 03}   
       condition:   
           5 of them   
   }

Labels / Tags

Labels: binary curve25519 loaders maas nullmixer powershell seo poisoning trojan

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.