Extracted

• • Target
    143DE914DA5EB0688EE6C86B7891BB14.exe
  • Size 412KB
  • SHA256 797e297900f39ba5b139b3a5d7c61e25fed7a8d130bc66868c2db2d58234c4de
  • MD5 143de914da5eb0688ee6c86b7891bb14
  • SHA1 01aad18a8659efa60d3ac1b9ec009311556dc85a
  • SHA512 03162759391e20fece78acd3b23758d9d149894362df0127da4733d6475a48f1cb3ca5df6d129c14fbc57df06d94b5d7c2281de9a92c3462d0edbc9cc31c532e
  • MD5 SHA1 SHA512

  Score

  10^/10

  fickerstealerdiscoveryinfostealerspywarestealer

  • fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2