‘Ficker’ Infostealer Is After Your Credit Cards and Crypto Wallets

guest · Aug 12, 2021

‘Ficker’ Infostealer Is After Your Credit Cards and Crypto Wallets
August 12, 2021
https://www.technadu.com/ficker-infostealer-after-credit-cards-crypto-wallets/294523/

‘Ficker’ is out there, looking to grab your credit card info, login credentials, crypto, and email accounts.

The malware is dropped through laced Word documents that arrive via spam mail campaigns.

The data is encrypted and exfiltrated on the fly, sent directly to the C2 without storing anything locally.

Click to expand...

‘Ficker’ is an infostealer written in Rust and targeting Windows systems, offered to cybercriminals as a MaaS (malware as a service) on Russian-speaking hacker forums. It was first uncovered last year, noticed distributed via Trojanized websites that promised free access to Spotify and YouTube Premium.

This year, the program is expanding and getting more impactful. ‘Ficker’ can target and steal information stored or entered in web browsers, FTP clients, and other apps, going mainly for credit card details as well as crypto-wallets. As such, it’s going directly for the money.
Click to expand...

A report on the BlackBerry blog describes a malware that’s being actively developed and promoted on various forums, with the author posting periodically to update the community of the latest improvements implemented on Ficker.
Recently, the deployment of the malware begun involving ‘Hancitor’, a malware that uses Trojanized MS Word documents delivered as extensions on spam emails.

The malware is injected into a svchost.exe instance on the compromised system to evade detection and hide its activity, and it first runs a keyboard layout check to exclude the following countries: Russia, Belarus, Uzbekistan, Armenia, Kazakhstan, and Azerbaijan.
Click to expand...

In addition to the above, Ficker can also capture screenshots by allowing the remote user to send the relevant command right from the dashboard. This opens up a very wide spectrum of exploitation possibilities, as the actors may potentially steal any information from the victim.
Click to expand...

Blackberry: Threat Thursday: Ficker Infostealer Malware

Ficker offers several paid packages, with different levels of subscription fees to use their malicious program. Once the malware subscription is purchased, the malware author provides a web-based panel to the buyer to collect and examine information stolen from victims, as well as the executable of the information stealer itself.

Since its introduction last year, Ficker has been deployed in a wide variety of ways. This is likely due to multiple threat actors using the malware differently in smaller individual campaigns.
Stolen Data
Unlike traditional information stealers, Ficker does not write its stolen data to disk.
Click to expand...

Log in or Sign up

‘Ficker’ Infostealer Is After Your Credit Cards and Crypto Wallets

guest Guest

Log in or Sign up

‘Ficker’ Infostealer Is After Your Credit Cards and Crypto Wallets

guest Guest

Useful Searches