Extracted

Extracted

• • Target
    0712_3006077542.doc
  • Size 915KB
  • SHA256 6c23b78efd34d5f7207287ba8364147b04559c711c7f32f15814c374aabf3d4b
  • MD5 a8522da79c82b2d2264985e9d63b625a
  • SHA1 34c7f34a07af103d4b2d4e32a1aaba89cebab575
  • SHA512 922c1a439ec6790fc5ff6d6b77c78baa1ee0c40cf7cdb79f09d899f35b7699d26801ccc730c0a332f9502d36b3f934529d8b05d926a3a47dd481b3d93a683134
  • MD5 SHA1 SHA512

  Score

  10^/10

  fickerstealerhancitor1207_cvefopdownloaderinfostealerspywarestealer

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2