ffdroider | 16ed7e7725384b25d7591fb35088b367e6062673ee2c80d7fa0808e8d1ebfb05

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/01/2023, 21:06 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16ed7e7725384b25d7591fb35088b367e6062673ee2c80d7fa0808e8d1ebfb05.exe
Size

1.3MB
MD5

3473191d876e4f97ea9a8f84b6e65e0f
SHA1

e5eb5169f57400194c5beecb106570689786e68b
SHA256

16ed7e7725384b25d7591fb35088b367e6062673ee2c80d7fa0808e8d1ebfb05
SHA512

effc568be67b5a9c84a8357103eb4fb846517ba04d2eedf4d69c6f7b73650c427a23c785c21b6d1e8aada5a4d31d73e91eeaeb0974ea39dcb8b056dd52f0fe48
SSDEEP

24576:2cURbdngEBJKuumfsEOJrpDI6mUfdRiETmqWVS6ZShnakTufpnBnkqrXepgfVYyq:2cURpgmJBr+JVIsdRi/MYRBnky3VRq

Score

10^/10

ffdroider spyware stealer

Malware Config

Extracted

Family

ffdroider

http://101.36.107.74

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1584	16ed7e7725384b25d7591fb35088b367e6062673ee2c80d7fa0808e8d1ebfb05.exe

C:\Users\Admin\AppData\Local\Temp\16ed7e7725384b25d7591fb35088b367e6062673ee2c80d7fa0808e8d1ebfb05.exe
"C:\Users\Admin\AppData\Local\Temp\16ed7e7725384b25d7591fb35088b367e6062673ee2c80d7fa0808e8d1ebfb05.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584

Network

No results found

101.36.107.74:80

16ed7e7725384b25d7591fb35088b367e6062673ee2c80d7fa0808e8d1ebfb05.exe

152 B
3

No results found

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1584-54-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1584-55-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/1584-56-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/1584-62-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download