Behavioral task
behavioral1
Sample
548-54-0x0000000000400000-0x0000000000467000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
548-54-0x0000000000400000-0x0000000000467000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
548-54-0x0000000000400000-0x0000000000467000-memory.dmp
-
Size
412KB
-
MD5
54c13685e50af58b80a52958b1a94db8
-
SHA1
9c238c3c6c7276eb020d92fbb62f4d76e997d262
-
SHA256
c5a88e32e1b088b8b947eb46930203946dda3f5f170d3dc3352eef13cd341679
-
SHA512
2508ca145f5b0ef26ac022390bee66eb23cd9c81afc427d67ae0bc52fbdb8b6358b435fc18290df340926e01e5fd57641bccd9e6bd58318394ad357aa854c4fb
-
SSDEEP
6144:jK0+5tKG8es+dC2g5OBXP7Atx9x6d3czad/6EAlQ6igB05+KUUC4lb7Ui4QZKquM:j/+5WpAl58vIMas0oTuvIM
Malware Config
Extracted
fickerstealer
linkappd.link:8080
Signatures
-
Fickerstealer family
Files
-
548-54-0x0000000000400000-0x0000000000467000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 312KB - Virtual size: 312KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE