Extracted

Extracted

• • Target
    niberius.dll
  • Size 268KB
  • SHA256 4dc9d5ee1debdba0388fbb112d4bbbc01bb782f015e798cced3fc2edb17ac557
  • MD5 d22d8bb38cf8d6a5ce6d8be4106350e7
  • SHA1 02fc51e6572a17f5dbbc32c4e3dd03cca3c51afe
  • SHA512 434e6b553bb96c5ae6b26d22cc35614f248f93a442e702395ce925578598bdf74eb884daf5a40d6c02cb1769eaf3dfdf858205e0c7b64f8afda38574991fcc41
  • MD5 SHA1 SHA512

  Score

  10^/10

  fickerstealerhancitor0707_wvcrdownloaderinfostealerspywarestealer

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2