Extracted

Extracted

• • Target

    0721_8261570716.xls

  • Size

    387KB

  • MD5

    4fcb584cd86c3a04b7e3357922204cb5

  • SHA1

    5f666bce38427026a8d36cd27b4ccdf558c6f790

  • SHA256

    fe62ee36d2ee6bedf3181beb5880115696396a51fe65870ade1a0af60a22f128

  • SHA512

    ed934a8115ef9a54bcf4e0e11704ae6f0c494656ab019b819903032ba1e6926e0b9da6b1a9b97f07f98ad1d39da8788f49da63eb49b8be22ecf2d3fa58ae61fb

  Score

  10^/10

  fickerstealerhancitor1907_hjfsddownloaderinfostealerspywarestealer

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2