General
-
Target
mixsix_20210918-161038
-
Size
477KB
-
Sample
210926-nx186segd4
-
MD5
b8824643d8f3e4f75d74454c17261825
-
SHA1
f46fe1a9b165472e502c7fbc6c7ea118d7b3ba93
-
SHA256
87981eaa1e89fb3feba7c2e1e07a237b8c1d06592333ba5c7800b4cb560b2c6d
-
SHA512
4d219f19d663da753726ad31e97fb0a8400920a090fe51ebf3e3b88e30861510230c33a2534af0029d043306c75bfee5f1e7ed666c913adc2b3c97875d3aa4d4
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20210918-161038.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
mixsix_20210918-161038.exe
Resource
win10-en-20210920
Malware Config
Extracted
fickerstealer
game2030.site:80
Targets
-
-
Target
mixsix_20210918-161038
-
Size
477KB
-
MD5
b8824643d8f3e4f75d74454c17261825
-
SHA1
f46fe1a9b165472e502c7fbc6c7ea118d7b3ba93
-
SHA256
87981eaa1e89fb3feba7c2e1e07a237b8c1d06592333ba5c7800b4cb560b2c6d
-
SHA512
4d219f19d663da753726ad31e97fb0a8400920a090fe51ebf3e3b88e30861510230c33a2534af0029d043306c75bfee5f1e7ed666c913adc2b3c97875d3aa4d4
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-