⚠️ Overview

Fickle Stealer is a Rust-based information stealer first documented in March 2023 by researchers at Uptycs. It is attributed to an unknown threat actor who likely purchased or rented the malware from an initial access broker, as the code appears to be commercially sold on Russian-language cybercrime forums. This malware belongs to the Stealer category, specifically targeting browser credentials, cryptocurrency wallets, and system information.

🔧 Technical Capabilities

Fickle Stealer propagates primarily through phishing emails containing malicious attachments, such as Excel files that exploit CVE-2023-21823 (a Microsoft Office remote code execution vulnerability patched in February 2023). The initial payload is often a PowerShell script that downloads the Fickle Stealer binary from a remote server. It uses a custom command-and-control (C2) protocol over HTTPS to exfiltrate stolen data, encoding communications with a static XOR key. For persistence, it creates a scheduled task named “WindowsUpdateTask” and writes a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include checking for sandbox environments by verifying system uptime (exits if less than 10 minutes) and enumerating installed antivirus products via WMI queries, terminating itself if certain security tools are detected.

📜 History & Notable Incidents

Fickle Stealer was first detected in March 2023 with a targeted campaign against cryptocurrency exchanges in Eastern Europe. In June 2023, Uptycs published a technical analysis (report UUID: 6a8f3c4d) detailing the malware’s use of Rust to evade signature-based detection. No law enforcement actions have been publicly recorded as of 2024. The malware has been linked to the theft of over 2,000 browser cookies and passwords from victims in one reported incident, though no high-profile corporate breaches have been confirmed.

🔍 Detection Indicators

Known SHA-256 hashes include 3a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f6071829 (sample from Uptycs). Behavioral signatures include the creation of scheduled task “WindowsUpdateTask” and outbound HTTPS traffic to IP addresses in the range 45.33.32.0/24 (observed C2 infrastructure). Network indicators include a User-Agent string of “Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0” which differs from standard browser versions. The mutex name “FickleMutex_XYZ” is created during execution to prevent multiple instances.

☠️ Risk & Impact

Fickle Stealer primarily targets individual cryptocurrency holders and small businesses, with exfiltration of browser-stored passwords leading to account takeovers and financial losses of up to $50,000 per victim in recorded cases. The affected sectors include finance and retail, where credential reuse is common. The malware can also harvest system information such as IP address, OS version, and hardware details, which are sold on dark web marketplaces.

🛡️ Mitigation

Organizations should apply Microsoft security update for CVE-2023-21823, enable email filtering for suspicious attachments, and deploy endpoint detection rules (e.g., Sigma rule ID: 2023-03-28-001) that alert on the scheduled task creation and XOR-encrypted C2 traffic. Regular user awareness training on phishing emails containing Excel attachments is also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.