fickerstealer | 5f3061aee58a7acc32cd8f2c2777dc2514e9cb6b13a80d2c289867a56d8cb2f8 | Triage

Analysis

max time kernel
8s
max time network
11s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-01-2023 15:04

Sharing

Report Analysis Logs

General

Target

5f3061aee58a7acc32cd8f2c2777dc2514e9cb6b13a80d2c289867a56d8cb2f8.exe
Size

4.8MB
MD5

dacb55c5b52f0749ddae6708496f6f7f
SHA1

008b432a937354ac690f0f5c2067785dc1c8ddef
SHA256

5f3061aee58a7acc32cd8f2c2777dc2514e9cb6b13a80d2c289867a56d8cb2f8
SHA512

0ed7aab9bbfffb443be13c60f6b8b103cd31436b0d1cbb2b2a5ec43a1e84ff09510a012f0003ef0d46e0c4ecc80f8a31c2ac4f7919dff2bc3152b51461fae744
SSDEEP

24576:/u7JMHhcvsRw7K0q/2cbyBCvNJeWKaij3yQZ9pxmQ3A9EhIAiqOXqgSWfaPSJaky:/uTv8w7G2cbOCjPmv9p+SvorASl87X

Score

10^/10

fickerstealer infostealer spyware stealer

Malware Config

Extracted

Family

fickerstealer

C2

91.240.118.51:253

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\5f3061aee58a7acc32cd8f2c2777dc2514e9cb6b13a80d2c289867a56d8cb2f8.exe
"C:\Users\Admin\AppData\Local\Temp\5f3061aee58a7acc32cd8f2c2777dc2514e9cb6b13a80d2c289867a56d8cb2f8.exe"
1⤵
PID:752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/752-55-0x0000000003520000-0x000000000395E000-memory.dmp

Filesize
4.2MB

Download
memory/752-56-0x0000000000400000-0x00000000008CF000-memory.dmp

Filesize
4.8MB

Download
memory/752-57-0x0000000000400000-0x00000000008CF000-memory.dmp

Filesize
4.8MB

Download