MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c83844722c5a6efc00ae36bf0a8548d3257e088d1547362227541f57ee98980. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FickerStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c83844722c5a6efc00ae36bf0a8548d3257e088d1547362227541f57ee98980
SHA3-384 hash: 1f478c8b89802282ccdb7212eb5f11c84a5f7b08e876aa9eb0b850b570f70f300250bc192858e94fc4da6d773a97bf70
SHA1 hash: 7ce552e8cf660fb6afa00a374c91f79b25be0952
MD5 hash: 03d7a8888dd522a8536773a65c6e5568
humanhash: illinois-seventeen-network-louisiana
File name:03d7a8888dd522a8536773a65c6e5568.exe
Download: download sample
Signature FickerStealer
Create hunting rule
File size:228'878 bytes
First seen:2021-02-14 16:32:01 UTC
Last seen:2021-02-14 18:56:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4af9fc1435afcdac900e97a88809922a (1 x FickerStealer)
ssdeep 3072:rdFrecnL9wgVawF6SrlHrE6E7xh6+hCLY9cv8QzvX0Br8+xmBfizxQnxPCU6pDjp:rqmpVaO6y46q0YnWEBBxX+xPaj9Vp
Threatray 67 similar samples on MalwareBazaar
TLSH 6424F0D179A0C833C6122C37DC45DEA15A3A65319FB6D1C737A8167E9F623E01A3B30A
Reporter abuse_ch
Tags:exe FickerStealer


Avatar
abuse_ch
FickerStealer C2:
185.234.247.233:80

Intelligence

File Origin
# of uploads :
2
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
03d7a8888dd522a8536773a65c6e5568.exe
Verdict:
Suspicious activity
Analysis date:
2021-02-14 16:34:57 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/f34363b9-9594-4a6e-a4e5-338b484af23d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Ficker
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117089/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.61584.31647.9099.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
DNS request
Sending an HTTP GET request
Creating a file
Connection attempt
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/607610
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8c83844722c5a6efc00ae36bf0a8548d3257e088d1547362227541f57ee98980/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-02-13 22:06:36 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rsbyirzcywto7qak4nv7bkcuruzfpyei2fkhgyrcova7k7xjrgaa._file
Verdict:
malicious
Similar samples:
0786b0ecb13a0fa33fb9269ce8a49ac1f986fcf4892b7b8c41edb73cba06482e
FickerStealer
3165b8d9ba511ac3f03f759a1cd159f268bbe7600eb9949cfd60142acecb25eb
FickerStealer
4c1e67f48961f4ed80ee2c64d32022d8d2e9b16ac1d84b2ca571d02318ad3a2b
FickerStealer
88eacbf15adf320e4d4b67d6aa47c95d686d724f9e3abe1524167ee0fd668b6a
FickerStealer
90929f4e6bd28d6a197fef323930502ac1a3dcc9de8d4dba02dc6702fd570e14
FickerStealer
9bbbfe2ba3734513d22aac9b236de6d169b43a202cd93d3e1cf08f474862435e
FickerStealer
c2d614dcb12132a96b1d0663513e67bb624771a0bb1070d2e8482f8c774a41ac
FickerStealer
e2b766a5e694e0fd5756ef168bbd5b436f1baba2e8b74c356dbd6f0e63184bdd
FickerStealer
e8906defdb9b6b6648f2d39348d4b250d809cb0fe3d53b70ace4abe2090d06df
FickerStealer
ee60159a403a0f52899c4b736d4a81cf8a73412e1deb6ffbe06be9e1ca221b82
FickerStealer
+ 57 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/210214-j673pzc16x/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Unpacked files
SH256 hash:
8c83844722c5a6efc00ae36bf0a8548d3257e088d1547362227541f57ee98980
MD5 hash:
03d7a8888dd522a8536773a65c6e5568
SHA1 hash:
7ce552e8cf660fb6afa00a374c91f79b25be0952
Link:
https://www.unpac.me/results/10d826e3-3255-4df9-9bfd-e64ba0a71085/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8c83844722c5a6efc00ae36bf0a8548d3257e088d1547362227541f57ee98980

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Ficker
Create hunting rule
Author:ditekSHen
Description:Detects Ficker infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FickerStealer

Executable exe 8c83844722c5a6efc00ae36bf0a8548d3257e088d1547362227541f57ee98980

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1009730/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/117089/

Comments