Extracted

• • Target

    jg2_2qua.exe

  • Size

    3.8MB

  • MD5

    da0fd627e5f973c05b64520a79ceb5c3

  • SHA1

    c331add626fffa0751618a03632d187a12626b85

  • SHA256

    cdff3d6732cbfee9eea53694ce2e72d165554a33c26b2acbc133b699bc0f1797

  • SHA512

    1ffddd165ecc4a1db3b159a9822e01c6a266132b474b840cc1dfefa116b5bf8d01c59593862acc709facd9c40ff11e6350daeefbcea26eaf8e91f2cd83f8ad67

  • SSDEEP

    49152:SvD9pgi6yJbrS7rpfylBJ9KjggRrxqA4D8dPRLVg56gWePmDUk/08CnMaPSC+Mkg:SvqcrS7rECjggRNLVuTW6usQPrFS5H

  Score

  10^/10

  ffdroiderspywarestealersuricataevasiontrojan

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider

  • FFDroider payload

  • suricata: ET MALWARE Win32/FFDroider CnC Activity

    suricata: ET MALWARE Win32/FFDroider CnC Activity

    suricata

  • suricata: ET MALWARE Win32/FFDroider CnC Activity M2

    suricata: ET MALWARE Win32/FFDroider CnC Activity M2

    suricata

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2