ffdroider | 305f0ad1b66a12f621f5a588dc414b1d8d449bd104e5b5e71054636f3a2644bd

General

Target

305f0ad1b66a12f621f5a588dc414b1d8d449bd104e5b5e71054636f3a2644bd.exe
Size

1.0MB
MD5

ddbc5d6023b19a129a124f93233d5f4d
SHA1

b64a38b8dd4e8ed57a51e6f58a85b1eb5513a444
SHA256

305f0ad1b66a12f621f5a588dc414b1d8d449bd104e5b5e71054636f3a2644bd
SHA512

7db57c8b843dff5156aca236556a5e78d2e1a6c980dac96da54e3de9832a210d92a7ca8b89bd51e1038150bb306b4ff7b7f524ea696ae707101811a4ff644c30
SSDEEP

24576:YP/Yk2eQji0+pBKcx4Z/2/qFatBkN8osTIQC2Y8rao2b2f8t+avrhqqk0:cJ2eQjiJ2Z+yFgBo8rae8YazhG

Score

10^/10

ffdroider evasion spyware stealer trojan

Malware Config

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	305f0ad1b66a12f621f5a588dc414b1d8d449bd104e5b5e71054636f3a2644bd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3016	305f0ad1b66a12f621f5a588dc414b1d8d449bd104e5b5e71054636f3a2644bd.exe
Token: SeManageVolumePrivilege	3016	305f0ad1b66a12f621f5a588dc414b1d8d449bd104e5b5e71054636f3a2644bd.exe
Token: SeManageVolumePrivilege	3016	305f0ad1b66a12f621f5a588dc414b1d8d449bd104e5b5e71054636f3a2644bd.exe

C:\Users\Admin\AppData\Local\Temp\305f0ad1b66a12f621f5a588dc414b1d8d449bd104e5b5e71054636f3a2644bd.exe
"C:\Users\Admin\AppData\Local\Temp\305f0ad1b66a12f621f5a588dc414b1d8d449bd104e5b5e71054636f3a2644bd.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:3016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-130-0x0000000003540000-0x0000000003550000-memory.dmp

Filesize
64KB

Download
memory/3016-136-0x00000000036A0000-0x00000000036B0000-memory.dmp

Filesize
64KB

Download
memory/3016-143-0x00000000041A0000-0x00000000041A8000-memory.dmp

Filesize
32KB

Download
memory/3016-142-0x0000000004180000-0x0000000004188000-memory.dmp

Filesize
32KB

Download
memory/3016-144-0x0000000004240000-0x0000000004248000-memory.dmp

Filesize
32KB

Download
memory/3016-145-0x0000000004380000-0x0000000004388000-memory.dmp

Filesize
32KB

Download
memory/3016-146-0x00000000044E0000-0x00000000044E8000-memory.dmp

Filesize
32KB

Download
memory/3016-147-0x0000000004890000-0x0000000004898000-memory.dmp

Filesize
32KB

Download
memory/3016-148-0x0000000004790000-0x0000000004798000-memory.dmp

Filesize
32KB

Download
memory/3016-149-0x00000000045F0000-0x00000000045F8000-memory.dmp

Filesize
32KB

Download
memory/3016-150-0x00000000041A0000-0x00000000041A8000-memory.dmp

Filesize
32KB

Download
memory/3016-151-0x00000000045F0000-0x00000000045F8000-memory.dmp

Filesize
32KB

Download
memory/3016-152-0x0000000004720000-0x0000000004728000-memory.dmp

Filesize
32KB

Download
memory/3016-153-0x00000000041A0000-0x00000000041A8000-memory.dmp

Filesize
32KB

Download
memory/3016-154-0x0000000004720000-0x0000000004728000-memory.dmp

Filesize
32KB

Download
memory/3016-155-0x00000000045F0000-0x00000000045F8000-memory.dmp

Filesize
32KB

Download
memory/3016-180-0x0000000004060000-0x0000000004068000-memory.dmp

Filesize
32KB

Download
memory/3016-181-0x0000000004080000-0x0000000004088000-memory.dmp

Filesize
32KB

Download
memory/3016-182-0x0000000004120000-0x0000000004128000-memory.dmp

Filesize
32KB

Download
memory/3016-183-0x0000000004350000-0x0000000004358000-memory.dmp

Filesize
32KB

Download
memory/3016-184-0x0000000004080000-0x0000000004088000-memory.dmp

Filesize
32KB

Download
memory/3016-185-0x0000000004080000-0x0000000004088000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing