General

  • Target

    Setup.exe

  • Size

    793.8MB

  • Sample

    241224-xcap6atram

  • MD5

    9a851a47a9bd2f92c61d2486d1be3064

  • SHA1

    3cda31c06db97246705d95dfcf4908eafb514b87

  • SHA256

    7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206

  • SHA512

    90340910dc1ee90ccfe7f451578de67c5ca32b95525157acd8b5bc2e99b9c0b2254bfb58997cc848a0ead871bc3f1e03dbb152d56aa709c4ecd3742404eec27b

  • SSDEEP

    196608:6spHQk/ICYcdYtOQYMvm6Iu+8RuJQHIsuRuJyPquRuJXMD349nt3njto03qJbYav:6csCYgIBH2XD349nt3nW03s8up

Malware Config

Extracted

Family

fickerstealer

C2

45.93.201.181:80

Targets

    • Target

      Setup.exe

    • Size

      793.8MB

    • MD5

      9a851a47a9bd2f92c61d2486d1be3064

    • SHA1

      3cda31c06db97246705d95dfcf4908eafb514b87

    • SHA256

      7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206

    • SHA512

      90340910dc1ee90ccfe7f451578de67c5ca32b95525157acd8b5bc2e99b9c0b2254bfb58997cc848a0ead871bc3f1e03dbb152d56aa709c4ecd3742404eec27b

    • SSDEEP

      196608:6spHQk/ICYcdYtOQYMvm6Iu+8RuJQHIsuRuJyPquRuJXMD349nt3njto03qJbYav:6csCYgIBH2XD349nt3nW03s8up

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Fickerstealer family

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks