MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c1e67f48961f4ed80ee2c64d32022d8d2e9b16ac1d84b2ca571d02318ad3a2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FickerStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c1e67f48961f4ed80ee2c64d32022d8d2e9b16ac1d84b2ca571d02318ad3a2b
SHA3-384 hash: 023d5e5a192d3fd54f9cb77f931649f9ddab342c5bcd9ac26065da2508ff0d04ffa51350b8ef2feda4cb9539ea0495b0
SHA1 hash: c87f5995e5530db7b1f540885fd455aebf64ae65
MD5 hash: 4a38cdc238cd1ac58f5925d8f87e199f
humanhash: december-dakota-north-march
File name:4a38cdc238cd1ac58f5925d8f87e199f.exe
Download: download sample
Signature FickerStealer
Create hunting rule
File size:337'934 bytes
First seen:2021-02-12 19:30:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9615cc80958cda761b2b66a788aa7603 (2 x FickerStealer)
ssdeep 6144:mnddYLf0GrxliQUjuv568Q4SB0WI5xnjHE19XqKLmK5WQ0k8/5c:mXYLfB9liQnB68aq619XqKL1AQZB
Threatray 66 similar samples on MalwareBazaar
TLSH 5574AE11FB91C034F5B652F84A7AD3F8A53D39B05B2490CB62D92AFE56386E0EC31356
Reporter abuse_ch
Tags:exe FickerStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://cdn.discordapp.com/attachments/807746340997431316/809208342068199434/118fir2crtg.exe
Verdict:
Malicious activity
Analysis date:
2021-02-11 04:16:40 UTC
Tags:
evasion trojan ficker stealer
Link:
https://app.any.run/tasks/e8c9417e-1f41-488f-9efd-52c0f9391347

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Ficker
Create hunting rule
Link:
https://www.capesandbox.com/analysis/116993/
Detection(s):
Win.Dropper.Glupteba-9831470-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
DNS request
Sending an HTTP GET request
Creating a file
Connection attempt
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/607151
Signature
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c1e67f48961f4ed80ee2c64d32022d8d2e9b16ac1d84b2ca571d02318ad3a2b/
Threat name:
Win32.Trojan.Ranumbot
Create hunting rule
Status:
Malicious
First seen:
2021-02-12 08:48:38 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0786b0ecb13a0fa33fb9269ce8a49ac1f986fcf4892b7b8c41edb73cba06482e
FickerStealer
3165b8d9ba511ac3f03f759a1cd159f268bbe7600eb9949cfd60142acecb25eb
FickerStealer
88eacbf15adf320e4d4b67d6aa47c95d686d724f9e3abe1524167ee0fd668b6a
FickerStealer
90929f4e6bd28d6a197fef323930502ac1a3dcc9de8d4dba02dc6702fd570e14
FickerStealer
9bbbfe2ba3734513d22aac9b236de6d169b43a202cd93d3e1cf08f474862435e
FickerStealer
ad7df9c3f3da564ae38fda8bfa0324a52ed98899696e763dae3bff7dad93262b
FickerStealer
c2d614dcb12132a96b1d0663513e67bb624771a0bb1070d2e8482f8c774a41ac
FickerStealer
e2b766a5e694e0fd5756ef168bbd5b436f1baba2e8b74c356dbd6f0e63184bdd
FickerStealer
e8906defdb9b6b6648f2d39348d4b250d809cb0fe3d53b70ace4abe2090d06df
FickerStealer
ee60159a403a0f52899c4b736d4a81cf8a73412e1deb6ffbe06be9e1ca221b82
FickerStealer
+ 56 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/210212-cjwwzph3yx/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Unpacked files
SH256 hash:
4c1e67f48961f4ed80ee2c64d32022d8d2e9b16ac1d84b2ca571d02318ad3a2b
MD5 hash:
4a38cdc238cd1ac58f5925d8f87e199f
SHA1 hash:
c87f5995e5530db7b1f540885fd455aebf64ae65
Link:
https://www.unpac.me/results/30fac979-8e95-43eb-abf6-4d5d00083ead/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4c1e67f48961f4ed80ee2c64d32022d8d2e9b16ac1d84b2ca571d02318ad3a2b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Ficker
Create hunting rule
Author:ditekSHen
Description:Detects Ficker infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FickerStealer

Executable exe 4c1e67f48961f4ed80ee2c64d32022d8d2e9b16ac1d84b2ca571d02318ad3a2b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1002245/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/116993/

Comments