General

  • Target

    44db05f808d1987031f1e3ed9b0c9430

  • Size

    534KB

  • Sample

    240106-a53kbadedj

  • MD5

    44db05f808d1987031f1e3ed9b0c9430

  • SHA1

    6d46101aa34ec94b889f86f402036bf78b9b8225

  • SHA256

    7161075691c2a958782a978fe9fe03877c57d0ead683273d47b22be10352c3a6

  • SHA512

    9ef3e3947d34414815c0fdc861c71f220de5276010d81f8761f5bd03baa9349ca403829d179018493e80a9666f5e8ce0ca800ccda787db850f850ca716d0f2b6

  • SSDEEP

    6144:i7im0etmuEnUZEvy2aGpw0PmyfQLKIHZrNVfs8VSMW0rLAb56dpLN4XQKJrsu:iGzfyTGpVPgRN2TMW0rwrsu

Malware Config

Extracted

Family

fickerstealer

C2

80.87.192.115:80

Targets

    • Target

      44db05f808d1987031f1e3ed9b0c9430

    • Size

      534KB

    • MD5

      44db05f808d1987031f1e3ed9b0c9430

    • SHA1

      6d46101aa34ec94b889f86f402036bf78b9b8225

    • SHA256

      7161075691c2a958782a978fe9fe03877c57d0ead683273d47b22be10352c3a6

    • SHA512

      9ef3e3947d34414815c0fdc861c71f220de5276010d81f8761f5bd03baa9349ca403829d179018493e80a9666f5e8ce0ca800ccda787db850f850ca716d0f2b6

    • SSDEEP

      6144:i7im0etmuEnUZEvy2aGpw0PmyfQLKIHZrNVfs8VSMW0rLAb56dpLN4XQKJrsu:iGzfyTGpVPgRN2TMW0rwrsu

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks