Extracted

Extracted

• • Target
    something.doc
  • Size 909KB
  • SHA256 ab97cc7eeb09fcd04bf4f694620169dd1132c713cb12d380c62745f605581d30
  • MD5 90f6edec8143a64b6751812aa075ea0f
  • SHA1 a4a0d8ef8d31bcaf08c65de2a402eec03d47985b
  • SHA512 5b9f8642aced7805b92453eedd965ed83505880481c05af2bd428aa3356c07db7a07604b2b3de7cb72c0c803570caa3598fe9ba2c38ab5c6f71b5a1d5b153e17
  • MD5 SHA1 SHA512

  Score

  10^/10

  fickerstealerhancitor1307_peat1downloaderinfostealerspywarestealer

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2