General

  • Target

    31d722331a9890b3ac394bf19fa6246397fbf79b37f23.exe

  • Size

    396KB

  • Sample

    221225-cp5e3seb41

  • MD5

    f6f84e80684195be3d018d72f0c337e4

  • SHA1

    71edaeb2a19028b2dc74f66b27245ac8ada88117

  • SHA256

    31d722331a9890b3ac394bf19fa6246397fbf79b37f23bc3fdde850afbc319ae

  • SHA512

    bf4dfaa3fe983d9cecc0da761f5b49416f604774509f38a6b6a29eff4e0baef9bae5f0a601e5cfdcb15b5d1aee83822309ec2fb27ce92ab0abaaf81c3366046a

  • SSDEEP

    6144:OwLUCKwEscIr5CAM13HfyTlJRAOvS8YGuz2ewEMXqaMM+k:pgCKwEscIr1Q/utbKmewEMXd5+k

Malware Config

Targets

    • Target

      31d722331a9890b3ac394bf19fa6246397fbf79b37f23.exe

    • Size

      396KB

    • MD5

      f6f84e80684195be3d018d72f0c337e4

    • SHA1

      71edaeb2a19028b2dc74f66b27245ac8ada88117

    • SHA256

      31d722331a9890b3ac394bf19fa6246397fbf79b37f23bc3fdde850afbc319ae

    • SHA512

      bf4dfaa3fe983d9cecc0da761f5b49416f604774509f38a6b6a29eff4e0baef9bae5f0a601e5cfdcb15b5d1aee83822309ec2fb27ce92ab0abaaf81c3366046a

    • SSDEEP

      6144:OwLUCKwEscIr5CAM13HfyTlJRAOvS8YGuz2ewEMXqaMM+k:pgCKwEscIr1Q/utbKmewEMXd5+k

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks