Extracted

• • Target

    2eada291b0125c056b9860d5500c480b95c1d223fffafe9ffac518b1a1e535cf.exe

  • Size

    12.3MB

  • MD5

    485e82a34baeb69c60dbd6f5361d2f6c

  • SHA1

    5ed78d891ffec76efe3fd580f0fea0fa147e620d

  • SHA256

    2eada291b0125c056b9860d5500c480b95c1d223fffafe9ffac518b1a1e535cf

  • SHA512

    e9aab6cb39be4e7c2136d0dbb7be8db8ebbd1e65142c86e0ffbeab61ed515774f00be6bfdea46d2183d65aa55723f6280cfd135415e84fafd62db7a5e0c02ea3

  • SSDEEP

    196608:871MmW1H/9FUAeD4/BB+PNhwy5C7uDWJ3LNXHlayW4ghxTXGSNAAeOxxT8zWspBF:8WJ/9FUA8YkPn7s7TdhwjXWAd7yN5

  Score

  10^/10

  fickerstealerevasioninfostealer

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2