03e5b81a1b2ce854a0974ec5bb4317c523fd18f57f681841d9feee783249724b.zip
- SHA256 bd12c09f8a2a5cd1068c38c8db699a6ca52b4cf31aba266a48e019e74dbee647
Password
infected
Behavioral task
behavioral1
Sample
03e5b81a1b2ce854a0974ec5bb4317c523fd18f57f681841d9feee783249724b.exe
Resource
win10v2004-20251223-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
03e5b81a1b2ce854a0974ec5bb4317c523fd18f57f681841d9feee783249724b.exe
Resource
win11-20251223-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target 03e5b81a1b2ce854a0974ec5bb4317c523fd18f57f681841d9feee783249724b.zip
- Size 437KB
- Sample251226-e1dslsc12a
- SHA256 bd12c09f8a2a5cd1068c38c8db699a6ca52b4cf31aba266a48e019e74dbee647
- MD5 13742e53d8e5879d6e4c20be1b2f11fd
- SHA1 87c3fc69fa4a11a6481d3d69016c4d95ee6f1fe5
- SHA512 e9a5ab7cf44b55d6564f058c665392fa75d63921d43e3f2eaee42b975cd95d4b0ddb4c911b5a067e27568742b5db44103b615bd907bf49b5f332d4b1ccf5081a
- SSDEEP 6144:ZoveLnjwEU/MP7EWQTAXxz7fVmjKEhVWGHqkXLby/+aAD07XCsQ0R7:uverj2qXZ7O/WsqkXfy/+Z0rR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Fickle stealer 1 IoCs
resource yara_rule static1/unpack001/03e5b81a1b2ce854a0974ec5bb4317c523fd18f57f681841d9feee783249724b family_fickle - Fickle family
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/03e5b81a1b2ce854a0974ec5bb4317c523fd18f57f681841d9feee783249724b
File Explorer
-
03e5b81a1b2ce854a0974ec5bb4317c523fd18f57f681841d9feee783249724b.zip.zip 437KB
-
03e5b81a1b2ce854a0974ec5bb4317c523fd18f57f681841d9feee783249724b.exe 780KB
03e5b81a1b2ce854a0974ec5bb4317c523fd18f57f681841d9feee783249724b
- IMPHASH c4fb18f76fb627a5da9a603944ab960c
- SHA256 03e5b81a1b2ce854a0974ec5bb4317c523fd18f57f681841d9feee783249724b
- MD5 793307d1003768525f18a1a531209337
- SHA1 6ff51e8db8d3edd7f244b4c539955d805962169c
- SHA512 a300af322cb833d4734105ca71a51987aaf08825ec9847dca6fd442567444535c4ef363b3619de0a8f4431ea328bd074e6b32197e87d6e40c56626a2cf997834
- SSDEEP 24576:nzym8pdlTkd5lus+dzviilKRFrdDKcWKAkOYEGR:CInWJUBZEe
- MD5 SHA1 SHA512 SSDEEP
-
Detects Fickle stealer
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
506661
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapReAlloc
HeapFree
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetLastError
FreeConsole
FindClose
DeleteFileW
CloseHandle
WinExec
GetModuleHandleW
GetComputerNameExW
GetUserDefaultLocaleName
WideCharToMultiByte
GetSystemInfo
CreateThread
ReleaseSRWLockExclusive
GetQueuedCompletionStatusEx
AcquireSRWLockExclusive
SetLastError
GetFinalPathNameByHandleW
Sleep
TlsSetValue
GetModuleHandleA
GetProcAddress
TlsGetValue
CreateMutexW
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
FindFirstFileW
ExitProcess
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
PostQueuedCompletionStatus
CreateIoCompletionPort
LoadLibraryExA
FreeLibrary
GetConsoleOutputCP
FlushFileBuffers
HeapSize
DecodePointer
LCMapStringW
CompareStringW
GetStringTypeW
GetFileType
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
WriteFile
RaiseException
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RtlUnwind
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
user32
EnumDisplaySettingsExW
EnumDisplayMonitors
SystemParametersInfoA
GetMonitorInfoW
MessageBoxW
oleaut32
SysAllocStringLen
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SysFreeString
VariantClear
SafeArrayDestroy
SafeArrayGetLBound
GetErrorInfo
rstrtmgr
RmGetList
RmRegisterResources
RmEndSession
RmStartSession
ntdll
RtlNtStatusToDosError
NtCancelIoFileEx
NtDeviceIoControlFile
NtReadFile
NtWriteFile
gdi32
GetDIBits
GetObjectW
CreateDCW
GetDeviceCaps
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SetStretchBltMode
StretchBlt
DeleteObject
SelectObject
advapi32
SystemFunction036
bcrypt
BCryptGenRandom
ole32
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
Name
.text
Size
571KB
Virtual Size
572KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
180KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
2KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
25KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=30795,
count=141, id=261, version=30795,
count=21, id=260, version=30795,
count=39, id=261, version=33218,
count=18, id=260, version=33218,
count=20, id=259, version=33218,
count=5, id=257, version=30795,
count=163, id=1, productName=Unmarked objects,
count=17, productName=Unmarked objects (old),
count=1, id=258, version=33522,