Extracted

Extracted

• • Target
    0712_0270003238.doc
  • Size 915KB
  • SHA256 ba50aec821d7d7ce4b89d46118bc403e4b1d1fbf1988bec8c1a916f2bfc971f0
  • MD5 18d810e437b4f70c3f1a4e0b6f81be88
  • SHA1 b038a8aa5504c6aaf45d6db697178ced354a44a6
  • SHA512 d0a1a46f57a675d3f02c504538915937c69b7aeb4bbbf7af0b95d77863bccf5052c15cce4935342f4cce76f3b86f8e9055d2a3d6b4b6415c20dc41a5424b1d4a
  • MD5 SHA1 SHA512

  Score

  10^/10

  fickerstealerhancitor1207_cvefopdownloaderinfostealerspywarestealer

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2