Extracted

Extracted

• • Target
    file
  • Size 759KB
  • SHA256 bc1456429475460bff1d0ec8eeb34d0a54a8fe2dcd08d12d3e7299dfc07bbd91
  • MD5 b42bc6ed08b75131eb5043a84235202c
  • SHA1 4eb0c4573d81b47275524da3b1505fdc57ab0d0f
  • SHA512 a1904ee65a7f95eba8c44a70e2eee363b9969d163a391dc9fd5d6e789d7794b109ee4f3d158ffe7a463677d9ec168adc6b6b7c1704a6433bb0052915b7cc32b5
  • MD5 SHA1 SHA512

  Score

  10^/10

  fickerstealerhancitor2306_vensipdownloaderinfostealerspywarestealer

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2