Extracted

• • Target

    SecuriteInfo.com.Win32.Malware-gen.30674.exe

  • Size

    3.7MB

  • MD5

    e33d877aeec8818d72035377f935768d

  • SHA1

    4ac4a0a50c9ef6da3054bd5323661f02d586c61c

  • SHA256

    fbf66aa4641ee40b89b7adeb3479c0e3366991ebbd22c513e25223ac62116141

  • SHA512

    7f955bd759fda37f1331c3825713a0d792e989914c432895c2429de636b413b5b890a6d069a349fb200501a02ce0a749c362a30217e896b765f5c7273d783671

  • SSDEEP

    98304:w9s1MuuckDr8MzdvX/Rn69WFTrKgVo5cPUjPPKw:wBuiDr8MRXBjF3NWcPUZ

  Score

  10^/10

  ffdroiderfacebookpersistencephishingspywarestealerevasiontrojan

  • Detected facebook phishing page

    phishingfacebook

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider

  • FFDroider payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2