General
-
Target
mixtwo_20210917-141359
-
Size
484KB
-
Sample
210926-nxkanaegc8
-
MD5
51a63646e7e8969ecbe95217f745b392
-
SHA1
044ea8ca6644a8c6eb095101b3d4e97b74409a58
-
SHA256
6b65f3fdb04176615b3016d1578265bf54ed01f026917ce0e556a95f5b32f061
-
SHA512
87efabc5b5a27631ee457211709ee71b9d8ff06242234676cff0a0cf6a430cc56028f3ea5d47de6c4313669e6ddb3cd12df0e9789e1c47b40451cf11387ee57c
Static task
static1
Behavioral task
behavioral1
Sample
mixtwo_20210917-141359.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
mixtwo_20210917-141359.exe
Resource
win10v20210408
Malware Config
Extracted
fickerstealer
game2030.site:80
Targets
-
-
Target
mixtwo_20210917-141359
-
Size
484KB
-
MD5
51a63646e7e8969ecbe95217f745b392
-
SHA1
044ea8ca6644a8c6eb095101b3d4e97b74409a58
-
SHA256
6b65f3fdb04176615b3016d1578265bf54ed01f026917ce0e556a95f5b32f061
-
SHA512
87efabc5b5a27631ee457211709ee71b9d8ff06242234676cff0a0cf6a430cc56028f3ea5d47de6c4313669e6ddb3cd12df0e9789e1c47b40451cf11387ee57c
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-