Overview

overview

10

Static

static

3

e3bf6d17db...18.exe

windows7-x64

10

e3bf6d17db...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3bf6d17db40ba1a967df90bc3ba3e4f_JaffaCakes118

  • Size

    415KB

  • Sample

    240407-brt7fsha9x

  • MD5

    e3bf6d17db40ba1a967df90bc3ba3e4f

  • SHA1

    25ae8565ae5eae94e3dd06955b908a3cdc53623f

  • SHA256

    f1107d0bce75510a76fc68a917c48afc205459471e22a95dbbd0e52dbd445075

  • SHA512

    6e15e220e693c9b217d845a020a1444a4c885e5853dbdc518a045464a40a0436a76fd8fd710e777d2588e1886af8262cf44eef6f508ac7c0139f658fa4fb2012

  • SSDEEP

    6144:TqUMjfPJt/I7RnfDmMOkFnjuZgFK+IdJsI5/eXaW0rLFb56dpLN4XQKJ3:+UsJpItjOanSAl6mcGXaW0rN3

Score
10/10
fickerstealerinfostealer

Malware Config

Extracted

Family

fickerstealer

C2

asfasfvcxvdbs.com:80

Targets

    • Target

      e3bf6d17db40ba1a967df90bc3ba3e4f_JaffaCakes118

    • Size

      415KB

    • MD5

      e3bf6d17db40ba1a967df90bc3ba3e4f

    • SHA1

      25ae8565ae5eae94e3dd06955b908a3cdc53623f

    • SHA256

      f1107d0bce75510a76fc68a917c48afc205459471e22a95dbbd0e52dbd445075

    • SHA512

      6e15e220e693c9b217d845a020a1444a4c885e5853dbdc518a045464a40a0436a76fd8fd710e777d2588e1886af8262cf44eef6f508ac7c0139f658fa4fb2012

    • SSDEEP

      6144:TqUMjfPJt/I7RnfDmMOkFnjuZgFK+IdJsI5/eXaW0rLFb56dpLN4XQKJ3:+UsJpItjOanSAl6mcGXaW0rN3

    Score
    10/10
    fickerstealerinfostealer

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

      infostealerfickerstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks