{"id":2972,"date":"2021-07-26T12:20:46","date_gmt":"2021-07-26T10:20:46","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=2972"},"modified":"2026-06-08T22:47:59","modified_gmt":"2026-06-08T22:47:59","slug":"fickerstealer-malspam-campaign","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/fickerstealer-malspam-campaign\/","title":{"rendered":"New Malspam campaign deploying FickerStealer Malware"},"content":{"rendered":"\n

In the past week, CERT-AGID observed a malspam<\/strong><\/em> campaign aimed at distributing the FickerStealer malware<\/em><\/strong> through the Hancitor<\/em><\/strong> loader<\/strong><\/em> to steal credentials present on the victim’s machine. The emails, themed around “Payments”<\/strong>, contained a Word<\/strong> or Excel<\/strong> document as an attachment, within which macros were embedded for downloading and executing the malware.<\/p>\n\n\n\n

Hancitor<\/h2>\n\n\n\n

Hancitor<\/strong> is a loader<\/em><\/strong>, that is, a malware whose task is to download (or extract) and execute a second malware for machine control. In the case of Hancitor, multiple research teams have identified FickerStealer<\/em><\/strong>, Sendsafe<\/em><\/strong>, and Cobalt Strike<\/em><\/strong> Beacons<\/em><\/strong> as payloads<\/em>.<\/p>\n\n\n\n

The malware is identified in the form of Word documents or Excel worksheets containing a DLL<\/strong> file and the macros necessary for extraction and execution of the same through the Microsoft RunDll32.exe<\/strong> program.<\/p>\n\n\n\n

FickerStealer<\/h2>\n\n\n\n

FickerStealer<\/strong> is a Malware-as-a-Service (MaaS)<\/strong>. This type of malware is offered to criminal groups affiliated with the developer group and requires payment of an access fee for (time-limited) use of the malware.<\/p>\n\n\n\n

In the case of FickerStealer<\/strong>, the product was advertised on Russian forums in the second half of 2020 and dedicated support channels were opened for its use on Telegram. Specifically, as observed by CERT-AGID, prices range from 90$ for one week up to 900$ for six months of activity.<\/p>\n\n\n\n

The malware belongs to the Info-Stealer<\/em><\/strong> family and was designed to steal credentials and sensitive data present in the operating system, installed browsers, and other software such as WinSCP, FileZilla, Steam, Discord, and ThunderBird.<\/p>\n\n\n\n

Additionally, FickerStealer enumerates crypto-wallets present in the C:\\Users\\<Username>\\AppData\\Roaming<\/em><\/strong> folder of the system and does not execute if the system language is one of the following:<\/p>\n\n\n\n