MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2d614dcb12132a96b1d0663513e67bb624771a0bb1070d2e8482f8c774a41ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FickerStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2d614dcb12132a96b1d0663513e67bb624771a0bb1070d2e8482f8c774a41ac
SHA3-384 hash: fc1ba81f8b8a6b17f80ca81f225d9c9b16bf30b9f0168786d3a0cb98f337fbb70b669a22b1b33f6b3974c18c108042e3
SHA1 hash: f10e8ad66197df32c865b67bcf1c0e667cc2bb45
MD5 hash: 29ea5434f02161845fe73c9844625da3
humanhash: sweet-nuts-yellow-stairway
File name:29ea5434f02161845fe73c9844625da3.exe
Download: download sample
Signature FickerStealer
Create hunting rule
File size:337'934 bytes
First seen:2021-02-12 19:27:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9615cc80958cda761b2b66a788aa7603 (2 x FickerStealer)
ssdeep 6144:LndaYLf0GrxlSQUjev56sNb/e+xTbKtst2znfXsLiUAa+2oO6RB0i2J1LJSc:LMYLfB9lSQ3B6sNb/FxK02zvseIFJEZA
Threatray 65 similar samples on MalwareBazaar
TLSH 1374BF10FBA1C034F5B752F44A6AC3F8A53D7AB15B2491CB52E96AEE1A342E0DC31357
Reporter abuse_ch
Tags:exe FickerStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://cdn.discordapp.com/attachments/807746340997431316/809208030532075550/118fik1crbiz.exe
Verdict:
Malicious activity
Analysis date:
2021-02-11 04:15:47 UTC
Tags:
evasion trojan ficker stealer
Link:
https://app.any.run/tasks/71569177-3af5-4068-8bde-91a1eefc6d99

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Ficker
Create hunting rule
Link:
https://www.capesandbox.com/analysis/116988/
Detection(s):
Win.Dropper.Glupteba-9831470-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
DNS request
Sending an HTTP GET request
Creating a file
Connection attempt
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/607183
Signature
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2d614dcb12132a96b1d0663513e67bb624771a0bb1070d2e8482f8c774a41ac/
Threat name:
Win32.Trojan.Ranumbot
Create hunting rule
Status:
Malicious
First seen:
2021-02-12 08:47:33 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0786b0ecb13a0fa33fb9269ce8a49ac1f986fcf4892b7b8c41edb73cba06482e
FickerStealer
3165b8d9ba511ac3f03f759a1cd159f268bbe7600eb9949cfd60142acecb25eb
FickerStealer
88eacbf15adf320e4d4b67d6aa47c95d686d724f9e3abe1524167ee0fd668b6a
FickerStealer
90929f4e6bd28d6a197fef323930502ac1a3dcc9de8d4dba02dc6702fd570e14
FickerStealer
9bbbfe2ba3734513d22aac9b236de6d169b43a202cd93d3e1cf08f474862435e
FickerStealer
ad7df9c3f3da564ae38fda8bfa0324a52ed98899696e763dae3bff7dad93262b
FickerStealer
e2b766a5e694e0fd5756ef168bbd5b436f1baba2e8b74c356dbd6f0e63184bdd
FickerStealer
e8906defdb9b6b6648f2d39348d4b250d809cb0fe3d53b70ace4abe2090d06df
FickerStealer
ee60159a403a0f52899c4b736d4a81cf8a73412e1deb6ffbe06be9e1ca221b82
FickerStealer
f11fdfc926699e7d517c6ec814c00c733363a6085a76de11d127d6168081369c
FickerStealer
+ 55 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/210212-697yjppg1s/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Unpacked files
SH256 hash:
c2d614dcb12132a96b1d0663513e67bb624771a0bb1070d2e8482f8c774a41ac
MD5 hash:
29ea5434f02161845fe73c9844625da3
SHA1 hash:
f10e8ad66197df32c865b67bcf1c0e667cc2bb45
Link:
https://www.unpac.me/results/81dc210b-7102-474c-ab80-d813f5bfc1b6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2d614dcb12132a96b1d0663513e67bb624771a0bb1070d2e8482f8c774a41ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Ficker
Create hunting rule
Author:ditekSHen
Description:Detects Ficker infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FickerStealer

Executable exe c2d614dcb12132a96b1d0663513e67bb624771a0bb1070d2e8482f8c774a41ac

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1002241/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/116988/

Comments