General
-
Target
mixsix_20210919-135057
-
Size
482KB
-
Sample
210926-nyefssefhl
-
MD5
7252985311a918b26f6fe70eb3dcbc91
-
SHA1
f515f7013a3ce9e4f165115e036938c06fae34b1
-
SHA256
875b055bc77f723ff15ebc6de6b7f07110796c7d085c03bfb99e603b86847e02
-
SHA512
8ad6dd268717fcc42e3a6ccf6006e13c27fd825ac32460a6f9003fb69ee531bf1f0e7e752fd29c769d0d8d60429d5ac85c4e67bff6e8d1141978e9431daedfc0
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20210919-135057.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
mixsix_20210919-135057.exe
Resource
win10v20210408
Malware Config
Extracted
fickerstealer
game2030.site:80
Targets
-
-
Target
mixsix_20210919-135057
-
Size
482KB
-
MD5
7252985311a918b26f6fe70eb3dcbc91
-
SHA1
f515f7013a3ce9e4f165115e036938c06fae34b1
-
SHA256
875b055bc77f723ff15ebc6de6b7f07110796c7d085c03bfb99e603b86847e02
-
SHA512
8ad6dd268717fcc42e3a6ccf6006e13c27fd825ac32460a6f9003fb69ee531bf1f0e7e752fd29c769d0d8d60429d5ac85c4e67bff6e8d1141978e9431daedfc0
-
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-