Extracted

• • Target

    Setup.exe

  • Size

    793.8MB

  • MD5

    9a851a47a9bd2f92c61d2486d1be3064

  • SHA1

    3cda31c06db97246705d95dfcf4908eafb514b87

  • SHA256

    7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206

  • SHA512

    90340910dc1ee90ccfe7f451578de67c5ca32b95525157acd8b5bc2e99b9c0b2254bfb58997cc848a0ead871bc3f1e03dbb152d56aa709c4ecd3742404eec27b

  • SSDEEP

    196608:6spHQk/ICYcdYtOQYMvm6Iu+8RuJQHIsuRuJyPquRuJXMD349nt3njto03qJbYav:6csCYgIBH2XD349nt3nW03s8up

  Score

  10^/10

  fickerstealerevasioninfostealerspywarestealer

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

    evasion

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1