General
-
Target
mixsix_20210918-083322
-
Size
477KB
-
Sample
210926-nxwnpaegd2
-
MD5
2fac8e63e19d0716a2f8f3ba74d59072
-
SHA1
026d9481ea89cd8532091581bba7288d85a29ea1
-
SHA256
7d18312efe76b08aab2d33f3dcc7c65ff5f7fc5b0215a8d3dcf67144163e0a41
-
SHA512
eb9eb5f707044fa4434cf34bce713513774d24a1e2ccf1949927c6207c59ebc1ff03c50f0a91b849bec1e6d5f66a28dec7b5029fdbad763ad9d6935eb3167127
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20210918-083322.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
mixsix_20210918-083322.exe
Resource
win10v20210408
Malware Config
Extracted
fickerstealer
game2030.site:80
Targets
-
-
Target
mixsix_20210918-083322
-
Size
477KB
-
MD5
2fac8e63e19d0716a2f8f3ba74d59072
-
SHA1
026d9481ea89cd8532091581bba7288d85a29ea1
-
SHA256
7d18312efe76b08aab2d33f3dcc7c65ff5f7fc5b0215a8d3dcf67144163e0a41
-
SHA512
eb9eb5f707044fa4434cf34bce713513774d24a1e2ccf1949927c6207c59ebc1ff03c50f0a91b849bec1e6d5f66a28dec7b5029fdbad763ad9d6935eb3167127
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-