ffdroider | 310f9471a8f858c6b02b8c70629efebf85956a02e7fef0d55f37a2e9731aac68

Analysis

max time kernel
72s
max time network
61s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

310f9471a8f858c6b02b8c70629efebf85956a02e7fef0d55f37a2e9731aac68.exe
Size

1.2MB
MD5

12ed77a382b88d0def763d0b7a35cbda
SHA1

e0f2bfc61e554a1c889cb49fb9a8cb605620bc26
SHA256

310f9471a8f858c6b02b8c70629efebf85956a02e7fef0d55f37a2e9731aac68
SHA512

c9fa3b05cc24e2f6815b01b76def6016a4cef9ca3cb389edb3bc790ce4639324987771ec2141e58afe0d641871656a7f2c46c8c6da1972177ce3a0c3810203f0
SSDEEP

24576:dOJE8pMemVlorMQS4ePb27twmZ1+ROYDj4hKR/xYtFDIdIfVnXxPxT:dtvemVgMQplThKR/x8IdgnX/T

Score

10^/10

ffdroider spyware stealer

Malware Config

Extracted

Family

ffdroider

http://101.36.107.74

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1932	310f9471a8f858c6b02b8c70629efebf85956a02e7fef0d55f37a2e9731aac68.exe

C:\Users\Admin\AppData\Local\Temp\310f9471a8f858c6b02b8c70629efebf85956a02e7fef0d55f37a2e9731aac68.exe
"C:\Users\Admin\AppData\Local\Temp\310f9471a8f858c6b02b8c70629efebf85956a02e7fef0d55f37a2e9731aac68.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1932-55-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1932-56-0x0000000002450000-0x0000000002460000-memory.dmp

Filesize
64KB

Download
memory/1932-62-0x0000000002DC0000-0x0000000002DD0000-memory.dmp

Filesize
64KB

Download
memory/1932-68-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download