ffdroider | cdff3d6732cbfee9eea53694ce2e72d165554a33c26b2acbc133b699bc0f1797

General

Target

jg2_2qua.exe
Size

3.8MB
MD5

da0fd627e5f973c05b64520a79ceb5c3
SHA1

c331add626fffa0751618a03632d187a12626b85
SHA256

cdff3d6732cbfee9eea53694ce2e72d165554a33c26b2acbc133b699bc0f1797
SHA512

1ffddd165ecc4a1db3b159a9822e01c6a266132b474b840cc1dfefa116b5bf8d01c59593862acc709facd9c40ff11e6350daeefbcea26eaf8e91f2cd83f8ad67
SSDEEP

49152:SvD9pgi6yJbrS7rpfylBJ9KjggRrxqA4D8dPRLVg56gWePmDUk/08CnMaPSC+Mkg:SvqcrS7rECjggRNLVuTW6usQPrFS5H

Score

10^/10

ffdroider evasion spyware stealer suricata trojan

Malware Config

Extracted

Family

ffdroider

C2

http://103.136.40.167

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider payload 3 IoCs

resource	yara_rule
behavioral2/memory/2308-130-0x0000000000400000-0x0000000000997000-memory.dmp	family_ffdroider
behavioral2/memory/2308-556-0x0000000000400000-0x0000000000997000-memory.dmp	family_ffdroider
behavioral2/memory/2308-1052-0x0000000000400000-0x0000000000997000-memory.dmp	family_ffdroider

suricata: ET MALWARE Win32/FFDroider CnC Activity
suricata: ET MALWARE Win32/FFDroider CnC Activity
suricata
suricata: ET MALWARE Win32/FFDroider CnC Activity M2
suricata: ET MALWARE Win32/FFDroider CnC Activity M2
suricata
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg2_2qua.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2308	jg2_2qua.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe
Token: SeManageVolumePrivilege	2308	jg2_2qua.exe

C:\Users\Admin\AppData\Local\Temp\jg2_2qua.exe
"C:\Users\Admin\AppData\Local\Temp\jg2_2qua.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-130-0x0000000000400000-0x0000000000997000-memory.dmp

Filesize
5.6MB

Download
memory/2308-131-0x00000000039E0000-0x00000000039F0000-memory.dmp

Filesize
64KB

Download
memory/2308-137-0x0000000004170000-0x0000000004180000-memory.dmp

Filesize
64KB

Download
memory/2308-143-0x0000000004C00000-0x0000000004C08000-memory.dmp

Filesize
32KB

Download
memory/2308-144-0x0000000004C20000-0x0000000004C28000-memory.dmp

Filesize
32KB

Download
memory/2308-145-0x0000000004CC0000-0x0000000004CC8000-memory.dmp

Filesize
32KB

Download
memory/2308-146-0x0000000004E00000-0x0000000004E08000-memory.dmp

Filesize
32KB

Download
memory/2308-147-0x0000000004E20000-0x0000000004E28000-memory.dmp

Filesize
32KB

Download
memory/2308-148-0x00000000050D0000-0x00000000050D8000-memory.dmp

Filesize
32KB

Download
memory/2308-149-0x0000000004FD0000-0x0000000004FD8000-memory.dmp

Filesize
32KB

Download
memory/2308-150-0x0000000004E40000-0x0000000004E48000-memory.dmp

Filesize
32KB

Download
memory/2308-151-0x0000000004C20000-0x0000000004C28000-memory.dmp

Filesize
32KB

Download
memory/2308-152-0x0000000004E40000-0x0000000004E48000-memory.dmp

Filesize
32KB

Download
memory/2308-153-0x0000000004C20000-0x0000000004C28000-memory.dmp

Filesize
32KB

Download
memory/2308-154-0x0000000004E40000-0x0000000004E48000-memory.dmp

Filesize
32KB

Download
memory/2308-179-0x0000000004C00000-0x0000000004C08000-memory.dmp

Filesize
32KB

Download
memory/2308-180-0x0000000004C20000-0x0000000004C28000-memory.dmp

Filesize
32KB

Download
memory/2308-181-0x0000000004CC0000-0x0000000004CC8000-memory.dmp

Filesize
32KB

Download
memory/2308-182-0x0000000004E10000-0x0000000004E18000-memory.dmp

Filesize
32KB

Download
memory/2308-183-0x0000000004E30000-0x0000000004E38000-memory.dmp

Filesize
32KB

Download
memory/2308-184-0x00000000050D0000-0x00000000050D8000-memory.dmp

Filesize
32KB

Download
memory/2308-185-0x0000000004FD0000-0x0000000004FD8000-memory.dmp

Filesize
32KB

Download
memory/2308-186-0x0000000004E40000-0x0000000004E48000-memory.dmp

Filesize
32KB

Download
memory/2308-187-0x0000000004C20000-0x0000000004C28000-memory.dmp

Filesize
32KB

Download
memory/2308-188-0x0000000004E40000-0x0000000004E48000-memory.dmp

Filesize
32KB

Download
memory/2308-189-0x0000000004F70000-0x0000000004F78000-memory.dmp

Filesize
32KB

Download
memory/2308-190-0x0000000004C20000-0x0000000004C28000-memory.dmp

Filesize
32KB

Download
memory/2308-191-0x0000000004F70000-0x0000000004F78000-memory.dmp

Filesize
32KB

Download
memory/2308-556-0x0000000000400000-0x0000000000997000-memory.dmp

Filesize
5.6MB

Download
memory/2308-1052-0x0000000000400000-0x0000000000997000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing