Behavioral task
behavioral1
Sample
2036-55-0x0000000000400000-0x0000000000991000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2036-55-0x0000000000400000-0x0000000000991000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
2036-55-0x0000000000400000-0x0000000000991000-memory.dmp
-
Size
5.6MB
-
MD5
b50b719e641009623d62dfa6c2aca4d3
-
SHA1
4d98d347ac8feb0b6e27019d6f59964f65947ef4
-
SHA256
4ccf2248a4a657d055510b4e78275da1813fac435def702569d65a3437c2517c
-
SHA512
f14b77394e5f288349aab87adc0b0ebfa455c22232e5e1a728c5a05a0aa9054b3e91cacf61b73a8e612d8b3284203bf471e13e1ae2309c7cb139ea6702caf86d
-
SSDEEP
98304:R9jDfKIhk/1n6knXxIlk40wSbTCbEiSjlvQ/qpyr0kBrvsrCvxQtbI+iZ7q1zPPw:jjLKIh4YkKvsrCpQ1I+7NAjtVa/u
Malware Config
Extracted
ffdroider
http://186.2.171.3
Signatures
-
FFDroider payload 1 IoCs
resource yara_rule sample family_ffdroider -
Ffdroider family
Files
-
2036-55-0x0000000000400000-0x0000000000991000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 1.9MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 243KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE