624C72ED822C5B7993D6F0B93AB7AA0A.exe

General
Target

624C72ED822C5B7993D6F0B93AB7AA0A.exe

Size

278KB

Sample

210328-kyc8rn91qe

Score
10 /10
MD5

624c72ed822c5b7993d6f0b93ab7aa0a

SHA1

e979d1a8121a4462848805c05f0768c03613c2f5

SHA256

dd6e8eff19234035ffec12d5df00fb016796fc19087925d2dc3763fc99bc2354

SHA512

3505f1a0eb881a45c30125d28bd7f0879d99cb437df1ffff26d87e9576d893459b43dd73fbe1eefa39a476576975e61792a59671d86e372911a2315cacd878b8

Malware Config

Extracted

Family fickerstealer
C2

deniedfight.com:80

Targets
Target

624C72ED822C5B7993D6F0B93AB7AA0A.exe

MD5

624c72ed822c5b7993d6f0b93ab7aa0a

Filesize

278KB

Score
10 /10
SHA1

e979d1a8121a4462848805c05f0768c03613c2f5

SHA256

dd6e8eff19234035ffec12d5df00fb016796fc19087925d2dc3763fc99bc2354

SHA512

3505f1a0eb881a45c30125d28bd7f0879d99cb437df1ffff26d87e9576d893459b43dd73fbe1eefa39a476576975e61792a59671d86e372911a2315cacd878b8

Tags

Signatures

  • fickerstealer

    Description

    Ficker is an infostealer written in Rust and ASM.

    Tags

  • Reads local data of messenger clients

    Description

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation