ffdroider | 2461acfa271f7d477ca53abe428d6adde1f285e115f188b2c82e321a94271a93

General

Target

2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Size

4.3MB
MD5

47a77e0680b5e159c610392034a8b905
SHA1

ab53d53a1878d2e441671a50fe25c27c98c27745
SHA256

2461acfa271f7d477ca53abe428d6adde1f285e115f188b2c82e321a94271a93
SHA512

17fa2068607b8777707a3194a6103429b3281ee5582525f60b036d396b42405b8eaa360af0d8551e61962cf69bd0fe9d0c4785aef5b5053af5cb7d25e12ada3e
SSDEEP

98304:GcPvZKq1eSV1mScVkFwPSfHbTLpSjLfiW+mp+pG2a0sJs0Uz9Fy:GcPRMQ8r6f7TLAjLaKApG2ab6Bz9U

Score

10^/10

ffdroider evasion spyware stealer trojan

Malware Config

Extracted

Family

ffdroider

C2

http://103.136.40.167

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider payload 2 IoCs

resource	yara_rule
behavioral2/memory/4924-132-0x0000000000400000-0x0000000000A32000-memory.dmp	family_ffdroider
behavioral2/memory/4924-1055-0x0000000000400000-0x0000000000A32000-memory.dmp	family_ffdroider

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Token: SeManageVolumePrivilege	4924	2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe

C:\Users\Admin\AppData\Local\Temp\2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
"C:\Users\Admin\AppData\Local\Temp\2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4924-132-0x0000000000400000-0x0000000000A32000-memory.dmp

Filesize
6.2MB

Download
memory/4924-133-0x00000000041A0000-0x00000000041B0000-memory.dmp

Filesize
64KB

Download
memory/4924-139-0x0000000004340000-0x0000000004350000-memory.dmp

Filesize
64KB

Download
memory/4924-145-0x0000000004DF0000-0x0000000004DF8000-memory.dmp

Filesize
32KB

Download
memory/4924-146-0x0000000004E10000-0x0000000004E18000-memory.dmp

Filesize
32KB

Download
memory/4924-147-0x0000000004EB0000-0x0000000004EB8000-memory.dmp

Filesize
32KB

Download
memory/4924-148-0x0000000005000000-0x0000000005008000-memory.dmp

Filesize
32KB

Download
memory/4924-149-0x0000000005020000-0x0000000005028000-memory.dmp

Filesize
32KB

Download
memory/4924-150-0x00000000052C0000-0x00000000052C8000-memory.dmp

Filesize
32KB

Download
memory/4924-151-0x00000000051C0000-0x00000000051C8000-memory.dmp

Filesize
32KB

Download
memory/4924-152-0x0000000005030000-0x0000000005038000-memory.dmp

Filesize
32KB

Download
memory/4924-153-0x0000000004E10000-0x0000000004E18000-memory.dmp

Filesize
32KB

Download
memory/4924-154-0x0000000005030000-0x0000000005038000-memory.dmp

Filesize
32KB

Download
memory/4924-155-0x0000000004E10000-0x0000000004E18000-memory.dmp

Filesize
32KB

Download
memory/4924-156-0x0000000005030000-0x0000000005038000-memory.dmp

Filesize
32KB

Download
memory/4924-181-0x0000000004DF0000-0x0000000004DF8000-memory.dmp

Filesize
32KB

Download
memory/4924-182-0x0000000004E10000-0x0000000004E18000-memory.dmp

Filesize
32KB

Download
memory/4924-183-0x0000000004EB0000-0x0000000004EB8000-memory.dmp

Filesize
32KB

Download
memory/4924-184-0x0000000004FF0000-0x0000000004FF8000-memory.dmp

Filesize
32KB

Download
memory/4924-185-0x0000000005010000-0x0000000005018000-memory.dmp

Filesize
32KB

Download
memory/4924-186-0x00000000052C0000-0x00000000052C8000-memory.dmp

Filesize
32KB

Download
memory/4924-187-0x00000000051C0000-0x00000000051C8000-memory.dmp

Filesize
32KB

Download
memory/4924-188-0x0000000005030000-0x0000000005038000-memory.dmp

Filesize
32KB

Download
memory/4924-189-0x0000000004E10000-0x0000000004E18000-memory.dmp

Filesize
32KB

Download
memory/4924-190-0x0000000005030000-0x0000000005038000-memory.dmp

Filesize
32KB

Download
memory/4924-191-0x0000000004E10000-0x0000000004E18000-memory.dmp

Filesize
32KB

Download
memory/4924-192-0x0000000005030000-0x0000000005038000-memory.dmp

Filesize
32KB

Download
memory/4924-1055-0x0000000000400000-0x0000000000A32000-memory.dmp

Filesize
6.2MB

Download

Analysis

Sharing