fickerstealer | 08d215fd35494280e6397e8bc527bd6de64eb78a73acd3bd07a01da376ed4cb7

Resubmissions

07-02-2022 00:34

Target

1cr.exe
Size

667KB
MD5

8c56ecce67e5e43e872863f41fe03eab
SHA1

ad4785bf01141163053f421d15fe76a460836c9b
SHA256

25eb1831bf580a45f9464bcf50ef2b3d35021f6eb5e42874b2dd8fd8544cf853
SHA512

63ade7eca68d011e979e2ff0568899136b3fec35370959fafe751edfff379e88b25431584e9cdc80c4d7354b9f6ed894ae4b9e6402d51a0af82f1544299c1a1c

Score

10^/10

Family

fickerstealer

109.234.35.192:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1240 set thread context of 744	1240	1cr.exe	27

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27
PID 1240 wrote to memory of 744	1240	1cr.exe	27

memory/744-62-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/744-64-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/744-69-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/744-66-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/744-61-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/744-59-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/744-63-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/744-60-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/744-65-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1240-54-0x0000000000F90000-0x000000000103E000-memory.dmp

Filesize
696KB

Download
memory/1240-55-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/1240-58-0x0000000004D20000-0x0000000004DC2000-memory.dmp

Filesize
648KB

Download
memory/1240-57-0x0000000000520000-0x0000000000528000-memory.dmp

Filesize
32KB

Download
memory/1240-56-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download