ffdroider | 37f06f87355592007d3f0a6acc3e0535b0a5d5d2e224280e5a5f8792cf88c9e4

General

Target

b1d856afe8ffd2649843d64affe9d4c3.exe
Size

3.9MB
MD5

b1d856afe8ffd2649843d64affe9d4c3
SHA1

6015d16a00f0c4ad3d68c8c83ae20305a1127a99
SHA256

37f06f87355592007d3f0a6acc3e0535b0a5d5d2e224280e5a5f8792cf88c9e4
SHA512

6c707636d934cfeefc42271d3bc4ca82cb243ed42b5bf2f999f7529cb4a761365bb94382d38ed4c0e9549ff9580d627414d3461ace467a8986faeaaf08707cab

Score

10^/10

ffdroider evasion spyware stealer trojan

Malware Config

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b1d856afe8ffd2649843d64affe9d4c3.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe

C:\Users\Admin\AppData\Local\Temp\b1d856afe8ffd2649843d64affe9d4c3.exe
"C:\Users\Admin\AppData\Local\Temp\b1d856afe8ffd2649843d64affe9d4c3.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:4120

Network

DNS

106.89.54.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

106.89.54.20.in-addr.arpa

IN PTR

Response
DNS

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

Remote address:

8.8.8.8:53

Request

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

IN PTR

Response
GET

http://152.32.193.91/seemorebty/poe.php?e=b1d856afe8ffd2649843d64affe9d4c3

b1d856afe8ffd2649843d64affe9d4c3.exe

Remote address:

152.32.193.91:80

Request

GET /seemorebty/poe.php?e=b1d856afe8ffd2649843d64affe9d4c3 HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0
Host: 152.32.193.91

Response

HTTP/1.1 200 OK

Date: Thu, 07 Apr 2022 14:59:55 GMT
Server: Apache
Upgrade: h2
Connection: Upgrade, close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

152.32.193.91:80

b1d856afe8ffd2649843d64affe9d4c3.exe

260 B
5
20.189.173.1:443

322 B
7
62.115.252.81:80

322 B
7
62.115.252.81:80

322 B
7
62.115.252.81:80

322 B
7
152.32.193.91:80

http://152.32.193.91/seemorebty/poe.php?e=b1d856afe8ffd2649843d64affe9d4c3

http

b1d856afe8ffd2649843d64affe9d4c3.exe

406 B
384 B
6
5

HTTP Request

GET http://152.32.193.91/seemorebty/poe.php?e=b1d856afe8ffd2649843d64affe9d4c3

HTTP Response

200

8.8.8.8:53

106.89.54.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

106.89.54.20.in-addr.arpa
8.8.8.8:53

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

dns

118 B
204 B
1
1

DNS Request

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4120-124-0x0000000003FB0000-0x0000000003FC0000-memory.dmp

Filesize
64KB

Download
memory/4120-130-0x0000000004150000-0x0000000004160000-memory.dmp

Filesize
64KB

Download
memory/4120-147-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/4120-151-0x00000000047B0000-0x00000000047B8000-memory.dmp

Filesize
32KB

Download
memory/4120-154-0x0000000004B70000-0x0000000004B78000-memory.dmp

Filesize
32KB

Download
memory/4120-156-0x0000000004740000-0x0000000004748000-memory.dmp

Filesize
32KB

Download
memory/4120-157-0x00000000030A0000-0x00000000030A8000-memory.dmp

Filesize
32KB

Download
memory/4120-158-0x00000000030A0000-0x00000000030A8000-memory.dmp

Filesize
32KB

Download
memory/4120-159-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-160-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-161-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-162-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-163-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-164-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-165-0x0000000004760000-0x0000000004768000-memory.dmp

Filesize
32KB

Download
memory/4120-166-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-167-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-168-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-169-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.