General

  • Target

    1a8b75020c3245b2a5621a51c2325e78f03f9c59810e2d263728109b96d8818f

  • Size

    220KB

  • Sample

    220512-aas3dsgecm

  • MD5

    e700eb4c6d47dc5ce4040e83f0105dd3

  • SHA1

    514e644eb7de24f36a08e3a13a7df9937d3e6e19

  • SHA256

    1a8b75020c3245b2a5621a51c2325e78f03f9c59810e2d263728109b96d8818f

  • SHA512

    2eb38bbdacadcedd2ee1e674296f4542059b998ec2a1f11a4f0df4fb02c3d7fe938a17a26fbe2e02de2d2b93ad641e20fabf9891550bfe1ce250c12121027371

Malware Config

Extracted

Family

fickerstealer

C2

gavrik.club:80

Targets

    • Target

      1a8b75020c3245b2a5621a51c2325e78f03f9c59810e2d263728109b96d8818f

    • Size

      220KB

    • MD5

      e700eb4c6d47dc5ce4040e83f0105dd3

    • SHA1

      514e644eb7de24f36a08e3a13a7df9937d3e6e19

    • SHA256

      1a8b75020c3245b2a5621a51c2325e78f03f9c59810e2d263728109b96d8818f

    • SHA512

      2eb38bbdacadcedd2ee1e674296f4542059b998ec2a1f11a4f0df4fb02c3d7fe938a17a26fbe2e02de2d2b93ad641e20fabf9891550bfe1ce250c12121027371

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks