General

  • Target

    42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d

  • Size

    480KB

  • Sample

    230124-gh4bnaac9v

  • MD5

    a8347795e62fd5ea607f98579c1d49ec

  • SHA1

    6e4b74e8f7447b6a7db13b4dbcefea258e430a4f

  • SHA256

    42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d

  • SHA512

    790726f6e8045324e1482e8614194299f1b501fa73f22ef516dddf5157404fbaeb7ef1983f4f771f34673d6749853a236ceff97be3e58d32740d2e08b7f5e349

  • SSDEEP

    6144:ALaTiFA3m+iCOvax2wVTqUiYTOefJC/cpTQbrZxBqZugCoZsBgbIOHH4:AuTH3mzCYA20mMOehjkbr7BUug6gbL4

Malware Config

Extracted

Family

fickerstealer

C2

fasdas.link:8080

Targets

    • Target

      42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d

    • Size

      480KB

    • MD5

      a8347795e62fd5ea607f98579c1d49ec

    • SHA1

      6e4b74e8f7447b6a7db13b4dbcefea258e430a4f

    • SHA256

      42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d

    • SHA512

      790726f6e8045324e1482e8614194299f1b501fa73f22ef516dddf5157404fbaeb7ef1983f4f771f34673d6749853a236ceff97be3e58d32740d2e08b7f5e349

    • SSDEEP

      6144:ALaTiFA3m+iCOvax2wVTqUiYTOefJC/cpTQbrZxBqZugCoZsBgbIOHH4:AuTH3mzCYA20mMOehjkbr7BUug6gbL4

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Tasks