General

  • Target

    library.exe

  • Size

    391KB

  • Sample

    221028-mfyahsfcf5

  • MD5

    33c62f580ece1c3cad5b05b87e1e760b

  • SHA1

    bbcccfa4d9980a168e9cb13634cc09bd6672ee00

  • SHA256

    a82d27f251f423a8016520aafce59827c39c4101d655dc85b01cd39e0b2f61a6

  • SHA512

    9735f1c790dac5556ad3c0cfe208566d01794c1be19e9704038e03168483ad00e4c6cfa02fa96c2a7185ca865b69fa40e9bcca8e166375fdd1be80da882846d1

  • SSDEEP

    12288:Q9tH7cSF9pKMynR8oOvqTPx3vt3grVppT:e1wwyfgM3vtwrLx

Malware Config

Extracted

Family

fickerstealer

C2

fickita.info:8080

Targets

    • Target

      library.exe

    • Size

      391KB

    • MD5

      33c62f580ece1c3cad5b05b87e1e760b

    • SHA1

      bbcccfa4d9980a168e9cb13634cc09bd6672ee00

    • SHA256

      a82d27f251f423a8016520aafce59827c39c4101d655dc85b01cd39e0b2f61a6

    • SHA512

      9735f1c790dac5556ad3c0cfe208566d01794c1be19e9704038e03168483ad00e4c6cfa02fa96c2a7185ca865b69fa40e9bcca8e166375fdd1be80da882846d1

    • SSDEEP

      12288:Q9tH7cSF9pKMynR8oOvqTPx3vt3grVppT:e1wwyfgM3vtwrLx

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks