fickerstealer | 94e60de577c84625da69f785ffe7e24c889bfa6923dc7b017c21e8a313e4e8e1 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 02:02

Sharing

Report Analysis Logs

General

Target

6hjusfd8.exe
Size

267KB
MD5

77be0dd6570301acac3634801676b5d7
SHA1

7394632d8cfc00c35570d219e49de63076294b6b
SHA256

94e60de577c84625da69f785ffe7e24c889bfa6923dc7b017c21e8a313e4e8e1
SHA512

4ca6db741c01f32f168c0d496494f8f46402885922074c010cd3085f8271bd374f5a3b07ec0717eb6fa9fe11f9c74de6d22a75690359381d08ecb6853150d07c
SSDEEP

6144:VMWdTMYHqhElscw4liVM1LDtG8esyh3hNn+:TdTJqWrEVcDYxN+

Score

10^/10

fickerstealer infostealer

Malware Config

Extracted

Family

fickerstealer

C2

sweyblidian.com:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org

C:\Users\Admin\AppData\Local\Temp\6hjusfd8.exe
"C:\Users\Admin\AppData\Local\Temp\6hjusfd8.exe"
1⤵
PID:4348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\kaosdma.txt
Filesize
12B

MD5
8cf4dec152a9d79a3d62202b886eda9b

SHA1
0c1b3d3d02c0b655aa3526a58486b84872f18cc2

SHA256
c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01

SHA512
a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd

Download Submit
memory/4348-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download