General
-
Target
mixsix_20210918-232939
-
Size
478KB
-
Sample
210926-nx9kjsefhj
-
MD5
93ea282916839faaa3eb613778881b81
-
SHA1
ddfeb2fb3bf140b1c8d7384fbdb8b2f652c7985a
-
SHA256
b0e6ddfd970372aaba019f96d025df8e3230e5fae54fc57ee7de3e69dfe20d1a
-
SHA512
bee171883c0fe9108b9a6f3ae22afb30806db9b195cbec1c6271774c8a748eaf6e5b44e4ccd2fa70061dab024dd351a04aa4aae8df38a7099fe1fd56a535152e
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20210918-232939.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
mixsix_20210918-232939.exe
Resource
win10-en-20210920
Malware Config
Extracted
fickerstealer
game2030.site:80
Targets
-
-
Target
mixsix_20210918-232939
-
Size
478KB
-
MD5
93ea282916839faaa3eb613778881b81
-
SHA1
ddfeb2fb3bf140b1c8d7384fbdb8b2f652c7985a
-
SHA256
b0e6ddfd970372aaba019f96d025df8e3230e5fae54fc57ee7de3e69dfe20d1a
-
SHA512
bee171883c0fe9108b9a6f3ae22afb30806db9b195cbec1c6271774c8a748eaf6e5b44e4ccd2fa70061dab024dd351a04aa4aae8df38a7099fe1fd56a535152e
-
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-