General
-
Target
mixsix_20210919-183217
-
Size
482KB
-
Sample
210926-nyfc4aege2
-
MD5
725fc46e4245c76f1365aaa7959b67d4
-
SHA1
cd25c8681fef3f57fb10564767a04194f4797a1f
-
SHA256
ce67cfc6138290ac9252744f77b9f2d09e3a60fcdf5b64224e0b245b751d01cf
-
SHA512
fbcd64b507cc63f4141db3ca3675359170fcac765c782b43a13b31affcd25b7bce2647403dffa0e8e5323624c911a21faf1097cb3df15ee56d72657e1660cfdc
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20210919-183217.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
mixsix_20210919-183217.exe
Resource
win10v20210408
Malware Config
Extracted
fickerstealer
game2030.site:80
Targets
-
-
Target
mixsix_20210919-183217
-
Size
482KB
-
MD5
725fc46e4245c76f1365aaa7959b67d4
-
SHA1
cd25c8681fef3f57fb10564767a04194f4797a1f
-
SHA256
ce67cfc6138290ac9252744f77b9f2d09e3a60fcdf5b64224e0b245b751d01cf
-
SHA512
fbcd64b507cc63f4141db3ca3675359170fcac765c782b43a13b31affcd25b7bce2647403dffa0e8e5323624c911a21faf1097cb3df15ee56d72657e1660cfdc
Score10/10-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-