Thread by @3xp0rtblog

#Malware #Stealer #FickerStealer

New interesting MaaS Ficker Stealer is written on Rust with using Assembly language.

SUC549.exe:
virustotal.com/gui/file/dc021…
app.any.run/tasks/04c558fa…

Special thanks to @James_inthe_box, @ThreatHive.

https://twitter.com/James_inthe_box/status/1318571872343052288?s=20

Build programming language: Rust + ASM
Panel programming language: Rust + React

Price: 90$ (1 week), 200$ (1 month), 500$ (3 month), 900$ (6 month).

Functional:
- Recursive stealing passwords, credit cards, forms from Chromium-Based, Mozilla (40+ browser).

- Stealing sessions cryptocurrency wallets
- Stealing from Windows Credentials Manager
- Stealing sessions from Pidgin, Steam, Discord, ThunderBird, etc (optional)
- Stealing FTP clients (FileZilla, WinScp)
- Stealing system information
- Taking screenshot
- Universal grabber

- Using memory for executing
- Server-side decrypting passwords, generating zip archive.

Selling on:
xss[.]is/threads/42458/
forum[.]exploit[.]in/topic/175885/

Contacts:
[e-mail] (Jabber)
ficker_sup (Telegrarm)

Interesting review on it: xss[.]is/threads/42458/

@James_inthe_box @JAMESWT_MHT @malwrhunterteam @0x7fff9 @Arkbird_SOLG @luc4m @P3pperP0tts @struppigel @ViriBack @ItsReallyNick @hexlax @fr0s7_ @albertzsigovits @pmelson @hasherezade @siri_urz @shotgunner101 @DynamicAnalysis @executemalware @FewAtoms @ochsenmeier

Ficker Stealer also mentioned by @shad0wintel

https://twitter.com/shad0wintel/status/1294576137495023616?s=20

.

@Abjuri5t @Bank_Security @BleepinComputer @Jan0fficial @abuse_ch @campuscodi @sS55752750 @malware_traffic @shad0wintel @k1k_