MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a05acba81358c991a65bec090a8d8be970ac43b60105736ae73ccc2ace00490. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FickerStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a05acba81358c991a65bec090a8d8be970ac43b60105736ae73ccc2ace00490
SHA3-384 hash: 5213035d434e0623119d6b3b6d520a395f1b38f2264e3913d33a25c10c3c4e78a980ef876109eab7e099679a8699fa2d
SHA1 hash: 01a8921fac84c993395319da1da3e8e798fa5d57
MD5 hash: f6ec8c19ab9a697d4d814776b8994558
humanhash: red-hotel-kitten-asparagus
File name:f6ec8c19ab9a697d4d814776b8994558.exe
Download: download sample
Signature FickerStealer
Create hunting rule
File size:376'832 bytes
First seen:2021-02-21 07:58:23 UTC
Last seen:2021-02-21 09:49:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 370afedd4e8e2c431858934dab986f76 (3 x FickerStealer)
ssdeep 6144:de7+66+IWTpDNKJIIAi5mqvqePPS7t+KYpzCL6W4OEIKydRhIdguMP:dM+6trRNKPAiQqvqoS7t+KYpk6W4kId+
Threatray 74 similar samples on MalwareBazaar
TLSH 5D84BF427852507EFD270EF59C9996172CA8FFF90A68AD87BFC804DC4F201B159A286D
Reporter abuse_ch
Tags:exe FickerStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ficker
Create hunting rule
Link:
https://www.capesandbox.com/analysis/118137/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.61604.28935.1270.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a window
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending an HTTP GET request
Creating a file
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/613396
Signature
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a05acba81358c991a65bec090a8d8be970ac43b60105736ae73ccc2ace00490/
Threat name:
Win32.Trojan.Fugrafa
Create hunting rule
Status:
Malicious
First seen:
2021-02-21 06:32:00 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0786b0ecb13a0fa33fb9269ce8a49ac1f986fcf4892b7b8c41edb73cba06482e
FickerStealer
55c76c4160faaf104652eb6da27dda571da4c92a1d4be2e17885c7d0ff3bcbc8
FickerStealer
7d9779fbd1bf96300874dfb62e5756308807a2c16a83de2a3f2edab794215946
FickerStealer
85467ed5f4ebf4fff082a35f3d97194f5e82d4e6d3712bb950874c665548018b
FickerStealer
86995c6af264f6f9eeb381bbe0578ba59b3134a38b57345910bf958a222abf3b
FickerStealer
8e4f25ae17e2868391994dee1de589d93b6162b085a726f76bd5b848330dd44d
FickerStealer
94e60de577c84625da69f785ffe7e24c889bfa6923dc7b017c21e8a313e4e8e1
FickerStealer
ad7df9c3f3da564ae38fda8bfa0324a52ed98899696e763dae3bff7dad93262b
FickerStealer
b1c680e9e56f42c48ca592fcd688500fb073ee3fdd8a36c584ab86cae9a225a0
FickerStealer
e8906defdb9b6b6648f2d39348d4b250d809cb0fe3d53b70ace4abe2090d06df
FickerStealer
+ 64 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/210221-617fkppsva/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Unpacked files
SH256 hash:
31eb962d08e80d2dc4857ff1adb09609a805db5a8d5822fe22152f512d887509
MD5 hash:
8f34c10ee1142b949937fc93bc1914f1
SHA1 hash:
3c831e6c054f4057824506d96312bec30e8270c4
Link:
https://www.unpac.me/results/97a94277-9f13-4485-b700-f24c9d532049/
SH256 hash:
0a05acba81358c991a65bec090a8d8be970ac43b60105736ae73ccc2ace00490
MD5 hash:
f6ec8c19ab9a697d4d814776b8994558
SHA1 hash:
01a8921fac84c993395319da1da3e8e798fa5d57
Link:
https://www.unpac.me/results/97a94277-9f13-4485-b700-f24c9d532049/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Ficker
Create hunting rule
Author:ditekSHen
Description:Detects Ficker infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FickerStealer

Executable exe 0a05acba81358c991a65bec090a8d8be970ac43b60105736ae73ccc2ace00490

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/941463/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/118137/

Comments