ffdroider

General

Target
B1209191392DE48946828E01F2C44C1FB38C09C894253.exe
Size 2.1MB
Sample221003-xyr7bscbd2
SHA256 b1209191392de48946828e01f2c44c1fb38c09c89425327b29fdcfb1c4dfa566
MD5 138610cf962ab62eb32d222a4a35b93a
SHA1 7348ff4e3894610a51e7d87a10500455f535c7e3
SHA512 c17f4235964de9de8333e21f10c47d7b36df15ea980b39b7e659d762b18a083fb62964a53cb9ed92cec3c2da71b09a66a2d4a2d11a77b93e15278f569fa1ee69
SSDEEP 49152:HQwudv0Z+VSX+DYS7jOtIE3Ft4mZtrWiU/mg6Yqs:ww+Icmmp7jOtIEVtBvPIgs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

ffdroider

C2

http://186.2.171.3

Targets

- Target
  B1209191392DE48946828E01F2C44C1FB38C09C894253.exe
- Size 2.1MB
- SHA256 b1209191392de48946828e01f2c44c1fb38c09c89425327b29fdcfb1c4dfa566
- MD5 138610cf962ab62eb32d222a4a35b93a
- SHA1 7348ff4e3894610a51e7d87a10500455f535c7e3
- SHA512 c17f4235964de9de8333e21f10c47d7b36df15ea980b39b7e659d762b18a083fb62964a53cb9ed92cec3c2da71b09a66a2d4a2d11a77b93e15278f569fa1ee69
- SSDEEP 49152:HQwudv0Z+VSX+DYS7jOtIE3Ft4mZtrWiU/mg6Yqs:ww+Icmmp7jOtIEVtBvPIgs
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ffdroider spyware stealer evasion trojan
- FFDroider
  Stealer targeting social media platform users first seen in April 2022.
  stealer ffdroider
- FFDroider payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

FFDroider payload

Reads user/profile data of web browsers

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2