General
-
Target
mixsix_20210918-102112
-
Size
477KB
-
Sample
210926-nxxkzsefgm
-
MD5
2d15f80745b3dcf7645967e668b1a7a5
-
SHA1
d8872198c68789bff9edc40f78b9760e0a39e181
-
SHA256
5b0b8f44ceded79b114f2a2bc0b928063138f19f4591604e2eff69ed17182140
-
SHA512
c99feee2aec1a7babda4d2c23b5126df6405106c13429216415acb4edf9bc125be93bc67658caf8bf23bf0ea8c9359bf91f5cee48b066d0b70363df3f64c7b11
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20210918-102112.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
mixsix_20210918-102112.exe
Resource
win10v20210408
Malware Config
Extracted
fickerstealer
game2030.site:80
Targets
-
-
Target
mixsix_20210918-102112
-
Size
477KB
-
MD5
2d15f80745b3dcf7645967e668b1a7a5
-
SHA1
d8872198c68789bff9edc40f78b9760e0a39e181
-
SHA256
5b0b8f44ceded79b114f2a2bc0b928063138f19f4591604e2eff69ed17182140
-
SHA512
c99feee2aec1a7babda4d2c23b5126df6405106c13429216415acb4edf9bc125be93bc67658caf8bf23bf0ea8c9359bf91f5cee48b066d0b70363df3f64c7b11
-
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-