ffdroider | 2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b | Triage

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15-06-2022 03:23

Sharing

Report Analysis Logs

General

Target

2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b.exe
Size

4.2MB
MD5

b79ee649d8daf87220a0f4953a5253c1
SHA1

30c4d8afbc77afeeebd4067678d7bd8e33b8e5b9
SHA256

2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b
SHA512

0967348abd73bfcbdf354dcf018d15570462e3f5810468a0547ef2f6086dac8a6e22dd4747fa519504b6dbcca5bdfaee766878c30606299530725ebf9ed04f38

Score

10^/10

ffdroider stealer

Malware Config

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider Payload 1 IoCs

resource	yara_rule
behavioral2/memory/876-130-0x0000000000DA0000-0x00000000011DF000-memory.dmp	family_ffdroider

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4516	876	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b.exe
"C:\Users\Admin\AppData\Local\Temp\2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b.exe"
1⤵
PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 652
  2⤵
  - Program crash
  PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 876 -ip 876
1⤵
PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-130-0x0000000000DA0000-0x00000000011DF000-memory.dmp

Filesize
4.2MB

Download