SecuriteInfo.com.W32.AIDetect.malware1.22079.22854

General
Target

SecuriteInfo.com.W32.AIDetect.malware1.22079.22854

Size

283KB

Sample

210328-segdvhfhk6

Score
10 /10
MD5

7eea67caea8c17c85cfb90445f2bd57c

SHA1

1f66bd14914b7957bcb4e5c65b021d084dc624cc

SHA256

a995e75e37cb38fb000ee2c225b57608677d0272d39faa645b1fe13a873c22bb

SHA512

05b226675c70c9c591170a4eadb04eaad575a159eecd965168ac744febcec40032e1112ae61e09c5201a31d4907e924f1427efb440cc87a310ff6f9c22cb3c3c

Malware Config

Extracted

Family fickerstealer
C2

lukkeze.space:80

Targets
Target

SecuriteInfo.com.W32.AIDetect.malware1.22079.22854

MD5

7eea67caea8c17c85cfb90445f2bd57c

Filesize

283KB

Score
10 /10
SHA1

1f66bd14914b7957bcb4e5c65b021d084dc624cc

SHA256

a995e75e37cb38fb000ee2c225b57608677d0272d39faa645b1fe13a873c22bb

SHA512

05b226675c70c9c591170a4eadb04eaad575a159eecd965168ac744febcec40032e1112ae61e09c5201a31d4907e924f1427efb440cc87a310ff6f9c22cb3c3c

Tags

Signatures

  • fickerstealer

    Description

    Ficker is an infostealer written in Rust and ASM.

    Tags

  • Reads local data of messenger clients

    Description

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation