ec6be0fb86e6a04c77384287a40912f2e3d781c7c9d470a24d1445bda1ab0bf0.zip
- SHA256 a51547657cfdf720c89610f7eeec4510e58668e2619b6400c283379d33b950c6
Password
infected
Behavioral task
behavioral1
Sample
ec6be0fb86e6a04c77384287a40912f2e3d781c7c9d470a24d1445bda1ab0bf0.exe
Resource
win10v2004-20251223-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ec6be0fb86e6a04c77384287a40912f2e3d781c7c9d470a24d1445bda1ab0bf0.exe
Resource
win11-20251223-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target ec6be0fb86e6a04c77384287a40912f2e3d781c7c9d470a24d1445bda1ab0bf0.zip
- Size 438KB
- Sample251225-rft1bavrer
- SHA256 a51547657cfdf720c89610f7eeec4510e58668e2619b6400c283379d33b950c6
- MD5 af0d08fdb3c3671ed958d032d70e4def
- SHA1 7bdc5dd22648810aaf74085d353fcb449bcde226
- SHA512 43a58cd844d32127bcddefc2d0d202908d3bfbdd802ab4f7342e3d0f41a57a7fd19df375fd5011a2ec1576582d5e4fbecddfe16981852db3f9641fda66ee160a
- SSDEEP 12288:Bo5ksvRbf6F2vTrKEH+VlPu4zeWAMSxBfri:u5kaxpPKEeP24zcji
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Fickle stealer 1 IoCs
resource yara_rule static1/unpack001/ec6be0fb86e6a04c77384287a40912f2e3d781c7c9d470a24d1445bda1ab0bf0 family_fickle - Fickle family
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ec6be0fb86e6a04c77384287a40912f2e3d781c7c9d470a24d1445bda1ab0bf0
File Explorer
-
ec6be0fb86e6a04c77384287a40912f2e3d781c7c9d470a24d1445bda1ab0bf0.zip.zip 438KB
-
ec6be0fb86e6a04c77384287a40912f2e3d781c7c9d470a24d1445bda1ab0bf0.exe 792KB
ec6be0fb86e6a04c77384287a40912f2e3d781c7c9d470a24d1445bda1ab0bf0
- IMPHASH 7b952ea950009a3fffb1b8c14db016fa
- SHA256 ec6be0fb86e6a04c77384287a40912f2e3d781c7c9d470a24d1445bda1ab0bf0
- MD5 640e3c3f124401337228a709f03026bd
- SHA1 69cd3003117b259c9d4a4ffb920137fcef98cd51
- SHA512 288a342c04ac5eeb757ee13d0801873fdd0dd0979c1705b73371dad1923453d892076bf04a7d50b7f29c05d26bb5a6d04bd569b3c158826eaa8178ad07fb0f43
- SSDEEP 24576:w409iWcHWcqMoLymbGYjK6FSEx7AY/xxXZVLY1XYFw:M73yEHs1Ow
- MD5 SHA1 SHA512 SSDEEP
-
Detects Fickle stealer
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
506031
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapReAlloc
HeapFree
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetLastError
FreeConsole
FindClose
DeleteFileW
CloseHandle
WinExec
GetSystemInfo
CreateThread
GetUserDefaultLocaleName
WideCharToMultiByte
GetComputerNameExW
GetModuleHandleW
ReleaseSRWLockExclusive
GetQueuedCompletionStatusEx
AcquireSRWLockExclusive
SetLastError
GetFinalPathNameByHandleW
Sleep
TlsSetValue
GetModuleHandleA
GetProcAddress
TlsGetValue
CreateMutexW
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
FindFirstFileW
ExitProcess
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
PostQueuedCompletionStatus
CreateIoCompletionPort
LoadLibraryExA
FreeLibrary
GetConsoleOutputCP
FlushFileBuffers
HeapSize
DecodePointer
LCMapStringW
CompareStringW
GetStringTypeW
GetFileType
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
WriteFile
RaiseException
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RtlUnwind
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
user32
EnumDisplayMonitors
GetMonitorInfoW
SystemParametersInfoA
EnumDisplaySettingsExW
MessageBoxW
oleaut32
SysAllocStringLen
VariantClear
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
SysStringLen
GetErrorInfo
SysFreeString
SafeArrayAccessData
SafeArrayUnaccessData
ole32
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
rstrtmgr
RmEndSession
RmGetList
RmStartSession
RmRegisterResources
ntdll
NtReadFile
NtDeviceIoControlFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtWriteFile
gdi32
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
GetDeviceCaps
CreateDCW
DeleteDC
StretchBlt
GetDIBits
DeleteObject
GetObjectW
advapi32
SystemFunction036
bcrypt
BCryptGenRandom
Name
.text
Size
572KB
Virtual Size
572KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
180KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=30795,
count=141, id=261, version=30795,
count=21, id=260, version=30795,
count=39, id=261, version=33218,
count=18, id=260, version=33218,
count=20, id=259, version=33218,
count=5, id=257, version=30795,
count=164, id=1, productName=Unmarked objects,
count=17, productName=Unmarked objects (old),
count=1, id=258, version=33522,