Overview

overview

10

Static

static

10

airbnb.exe

windows7_x64

10

airbnb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    airbnb.exe

  • Size

    3.3MB

  • Sample

    220522-fyz4haaggn

  • MD5

    dfb6e366186969c7265e5602a4b85335

  • SHA1

    f20c75e427ef43b853b4a053e98cd301cae331c1

  • SHA256

    d77bea86bd4c36acae410d6dec8e012439e36d6226d99f1fd7de29827fca3835

  • SHA512

    5420980743bb7772ffd1cda00acbbe921ec3746c20db17b653fc8cd4c795db33d516ea82604f43b61dc94ca6a949d21338f3d3528b3ac0f168bdae4676af9019

Score
10/10
ffdroiderevasionspywarestealersuricatatrojan

Malware Config

Targets

    • Target

      airbnb.exe

    • Size

      3.3MB

    • MD5

      dfb6e366186969c7265e5602a4b85335

    • SHA1

      f20c75e427ef43b853b4a053e98cd301cae331c1

    • SHA256

      d77bea86bd4c36acae410d6dec8e012439e36d6226d99f1fd7de29827fca3835

    • SHA512

      5420980743bb7772ffd1cda00acbbe921ec3746c20db17b653fc8cd4c795db33d516ea82604f43b61dc94ca6a949d21338f3d3528b3ac0f168bdae4676af9019

    Score
    10/10
    ffdroiderspywarestealersuricataevasiontrojan

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

      stealerffdroider

    • FFDroider Payload

    • suricata: ET MALWARE Win32/FFDroider CnC Activity

      suricata: ET MALWARE Win32/FFDroider CnC Activity

      suricata

    • suricata: ET MALWARE Win32/FFDroider CnC Activity M2

      suricata: ET MALWARE Win32/FFDroider CnC Activity M2

      suricata

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks