Analysis
-
max time kernel
153s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
28-05-2022 04:12
General
-
Target
0281a3df4c3626c144d04210e776a0f6078244e64eb0713c468bca08d09b7e5d.exe
-
Size
3.8MB
-
MD5
2fae1bd2d77f021a0b327b5356c4d2c7
-
SHA1
cd0bb537e1aec361a8abe141795718ab2f37bf79
-
SHA256
0281a3df4c3626c144d04210e776a0f6078244e64eb0713c468bca08d09b7e5d
-
SHA512
0582506405d6fb6c6c94a0d6dbd2067dd7c3fd9f54a8a92ed1248b89fd216b28e2b3489fdfb7ce8dd5888eb021eefd9159864b5aa4cc5a5408847828eb123d6b
Score
10/10
Malware Config
Signatures
-
FFDroider
Stealer targeting social media platform users first seen in April 2022.
-
FFDroider Payload 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0281a3df4c3626c144d04210e776a0f6078244e64eb0713c468bca08d09b7e5d.exe"C:\Users\Admin\AppData\Local\Temp\0281a3df4c3626c144d04210e776a0f6078244e64eb0713c468bca08d09b7e5d.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
5.9MB
-
Filesize
5.9MB