Extracted

• • Target

    0a4fc3b3c56f55b896cf5133aed53ff4.exe

  • Size

    431KB

  • MD5

    0a4fc3b3c56f55b896cf5133aed53ff4

  • SHA1

    aa8c1a3048a293b2a3f7f365e2f4b96c509ca486

  • SHA256

    51837ac7f938c666b56d73e1e38f8d75dae2c6116ec2bc49fd992fa6aeab6546

  • SHA512

    a5a508eec2bfe9e52fd59725f4f902986028ba60332f0338a811d67ca03df7e49fea3359ac6486b0c4c9d3da039660d5eccbfb01b73745ec73ed0651b5b411d9

  • SSDEEP

    12288:CKDyIHvkxMnl6TowPRhNo7pQTI5LKBH0fbrs:RGAvkeWocN4pQEcpgrs

  Score

  10^/10

  fickerstealerdiscoveryinfostealerspywarestealer

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2