Extracted

Extracted

• • Target

    0721_7525265361.xls

  • Size

    387KB

  • MD5

    ddfe01c006b3cbf4a6929073e235a8b4

  • SHA1

    59b4c1ec4cb1428b812726c00a29aee9138d46b2

  • SHA256

    39647d1829fcc16d1e20e0b6ccb582b85ff0a37f8530395628c44eda88542ed3

  • SHA512

    48f27d9f21125c49bbd4396b97d9ac69ec363f63c526028fed1734627329d6331332c81a75392807c0d52d1af071bdbee6fa5bce3abe837556d9dcd5885adc1a

  Score

  10^/10

  fickerstealerhancitor1907_hjfsddownloaderinfostealerspywarestealer

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2