MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6af404cb4c891c28895a5f311f6ead7c4007a5eb16b3be8c77630998a08895f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FickerStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6af404cb4c891c28895a5f311f6ead7c4007a5eb16b3be8c77630998a08895f
SHA3-384 hash: b1d1046206ef7b5a1bb0efb4ccf378ce9b4af1d0d308f2838618bcd4aa37a9590e2fc70acdf7dab521ba663c142c691e
SHA1 hash: 97c7a13dd448dd6eaea61f483d4773a4db170377
MD5 hash: 90f0a1d320604210dd8423825976b3b1
humanhash: colorado-monkey-utah-four
File name:90f0a1d320604210dd8423825976b3b1.exe
Download: download sample
Signature FickerStealer
Create hunting rule
File size:376'832 bytes
First seen:2021-02-22 19:18:50 UTC
Last seen:2021-02-22 20:29:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 370afedd4e8e2c431858934dab986f76 (3 x FickerStealer)
ssdeep 6144:xe7+66+IWT2jR1k1Uo9b82bodo+cbknSNaHrdAybSxy8dFurgmGROMP:xM+6trS4X07ceCFFuUZnP
Threatray 75 similar samples on MalwareBazaar
TLSH 3984BEB135CC9BB2F57B1673E87183D69929FB304F1295A3DBD403A845302861A3AE77
Reporter abuse_ch
Tags:exe FickerStealer


Avatar
abuse_ch
FickerStealer C2:
139.59.47.124:81

Intelligence

File Origin
# of uploads :
2
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ficker
Create hunting rule
Link:
https://www.capesandbox.com/analysis/118404/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.61604.10978.31323.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a window
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending an HTTP GET request
Creating a file
Sending a custom TCP request
Reading critical registry keys
Delayed reading of the file
Sending a UDP request
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/614547
Signature
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6af404cb4c891c28895a5f311f6ead7c4007a5eb16b3be8c77630998a08895f/
Threat name:
Win32.Trojan.Fugrafa
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 19:19:08 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u2xuatfuzci4fcevuxzrd5xk27caa6s6wfvtx2ghoyyjtcqirfpq._file
Verdict:
malicious
Similar samples:
0786b0ecb13a0fa33fb9269ce8a49ac1f986fcf4892b7b8c41edb73cba06482e
FickerStealer
0a05acba81358c991a65bec090a8d8be970ac43b60105736ae73ccc2ace00490
FickerStealer
55c76c4160faaf104652eb6da27dda571da4c92a1d4be2e17885c7d0ff3bcbc8
FickerStealer
7d9779fbd1bf96300874dfb62e5756308807a2c16a83de2a3f2edab794215946
FickerStealer
8e4f25ae17e2868391994dee1de589d93b6162b085a726f76bd5b848330dd44d
FickerStealer
94e60de577c84625da69f785ffe7e24c889bfa6923dc7b017c21e8a313e4e8e1
FickerStealer
ad7df9c3f3da564ae38fda8bfa0324a52ed98899696e763dae3bff7dad93262b
FickerStealer
e8906defdb9b6b6648f2d39348d4b250d809cb0fe3d53b70ace4abe2090d06df
FickerStealer
ee60159a403a0f52899c4b736d4a81cf8a73412e1deb6ffbe06be9e1ca221b82
FickerStealer
efc9dc681fbad59d5fb6f1a66b433d6a7a7b7144444413d78f9d71dd184039ab
FickerStealer
+ 65 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware
Link:
https://tria.ge/reports/210222-3mbmdchmaa/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
a6af404cb4c891c28895a5f311f6ead7c4007a5eb16b3be8c77630998a08895f
MD5 hash:
90f0a1d320604210dd8423825976b3b1
SHA1 hash:
97c7a13dd448dd6eaea61f483d4773a4db170377
Link:
https://www.unpac.me/results/89c8bf4e-d85b-4820-a956-0d455e6e8e0f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/a6af404cb4c891c28895a5f311f6ead7c4007a5eb16b3be8c77630998a08895f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Ficker
Create hunting rule
Author:ditekSHen
Description:Detects Ficker infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FickerStealer

Executable exe a6af404cb4c891c28895a5f311f6ead7c4007a5eb16b3be8c77630998a08895f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/941463/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/118404/

Comments