fickerstealer

General

Target

mixsix_20210921-000520
Size

509KB
Sample

210926-ny346aegam
MD5

4454da77052c1cd616d86eb5e543dbdf
SHA1

825fc2433bdf95a4ce689f140f4867cdcc284db6
SHA256

3a7f102877ef953f254a52c4154fb930001e6e5db6a468623ebeddb636ef7931
SHA512

8b4aa27c3cc3c7a04a33f6e118e93955fdceb2590d05c9f3d7ac698fbd21148d2493a3fb0b3c83dd38e51e6f38a0210776dfdea1f9b7f4e21942c6191be519a6

Score

10^/10

Malware Config

Extracted

Family

fickerstealer

C2

game2030.site:80

Targets

- Target
  
  mixsix_20210921-000520
- Size
  
  509KB
- MD5
  
  4454da77052c1cd616d86eb5e543dbdf
- SHA1
  
  825fc2433bdf95a4ce689f140f4867cdcc284db6
- SHA256
  
  3a7f102877ef953f254a52c4154fb930001e6e5db6a468623ebeddb636ef7931
- SHA512
  
  8b4aa27c3cc3c7a04a33f6e118e93955fdceb2590d05c9f3d7ac698fbd21148d2493a3fb0b3c83dd38e51e6f38a0210776dfdea1f9b7f4e21942c6191be519a6
Score

10^/10

fickerstealer infostealer discovery spyware stealer suricata
- Fickerstealer
  Ficker is an infostealer written in Rust and ASM.
  infostealer fickerstealer
- suricata: ET MALWARE Win32/Ficker Stealer Activity M3
  suricata: ET MALWARE Win32/Ficker Stealer Activity M3
  suricata
- Executes dropped EXE
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

suricata: ET MALWARE Win32/Ficker Stealer Activity M3

Executes dropped EXE

Reads local data of messenger clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2