fickerstealer | 42281d49da52812c4cd33228af087eaf[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
42281d49da52812c4cd33228af087eaf.exe
Size 391KB
Sample221201-wr42waee89
SHA256 58d1e777704216e668537c6db64d0178d44071736ed966eb3fc88bc05e6840c3
MD5 42281d49da52812c4cd33228af087eaf
SHA1 7779d21fc9d1ea46dc643dfd45fa32ba4f54e6e2
SHA512 5bdc8c9f4056a8ba7fd6a03f438e871cec4ded79f1d8886e40b44904626de204341b50b76024309e6d4354fa62d20b2d3e9c0df398013bf20c2808f73c3b65e5
SSDEEP 6144:cW3mkqlxrNBKiU6893YBwq3xj4/XjT7d6srMQW+bXvd0GsuFC1OlbTVdWnKfX:Lmk8TZUloBPsPj4KN/d0ouN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

fickerstealer

Malware Config

Extracted

Family

fickerstealer

blogsme.link:8080

Signatures

Fickerstealer family
fickerstealer

File Explorer

42281d49da52812c4cd33228af087eaf.exe

.exe 391KB

42281d49da52812c4cd33228af087eaf.exe

IMPHASH 4de0536eb25f693290ab642e3e63ef72
SHA256 58d1e777704216e668537c6db64d0178d44071736ed966eb3fc88bc05e6840c3
MD5 42281d49da52812c4cd33228af087eaf
SHA1 7779d21fc9d1ea46dc643dfd45fa32ba4f54e6e2
SHA512 5bdc8c9f4056a8ba7fd6a03f438e871cec4ded79f1d8886e40b44904626de204341b50b76024309e6d4354fa62d20b2d3e9c0df398013bf20c2808f73c3b65e5
SSDEEP 6144:cW3mkqlxrNBKiU6893YBwq3xj4/XjT7d6srMQW+bXvd0GsuFC1OlbTVdWnKfX:Lmk8TZUloBPsPj4KN/d0ouN
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

5312

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW SystemFunction036

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleDC CreateDIBSection DeleteObject GetCurrentObject GetObjectW SelectObject

kernel32

CloseHandle CreateDirectoryW CreateFileA CreateFileW CreateMutexA CreateToolhelp32Snapshot DeleteCriticalSection DeviceIoControl EnterCriticalSection FindClose FindFirstFileW FindNextFileW FormatMessageW GetComputerNameW GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetEnvironmentVariableW GetFileInformationByHandle GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetSystemInfo GetTimeZoneInformation GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA LocalFree OpenProcess Process32First Process32Next ReadFile ReleaseMutex RtlCaptureContext SetFilePointerEx SetHandleInformation SetLastError SetUnhandledExceptionFilter Sleep TlsAlloc TlsGetValue TlsSetValue WaitForSingleObjectEx WriteConsoleW WriteFile GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter TerminateProcess UnhandledExceptionFilter VirtualProtect VirtualQuery

user32

EnumDisplayDevicesW GetDC GetDesktopWindow GetKeyboardLayoutList GetSystemMetrics GetWindowRect

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _close _fmode _fpreset _getpid _initterm _iob _lock _lseek _onexit _open _read _unlock _vsnprintf abort atoi bsearch calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset realloc signal strcmp strlen strncmp vfprintf

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup closesocket connect freeaddrinfo getaddrinfo ioctlsocket recv send setsockopt shutdown

Name

.text

Size

318KB

Virtual Size

317KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE