Extracted

• • Target

    d61f135d2da176c567552241c77e4ebf274a18a2e475d2b6e8d1d3048ce1f623

  • Size

    3.2MB

  • MD5

    ff342251caa0735956b125a186882232

  • SHA1

    6213dc4b7493b59fb4439a812d887fcd250f13b8

  • SHA256

    d61f135d2da176c567552241c77e4ebf274a18a2e475d2b6e8d1d3048ce1f623

  • SHA512

    8caca67f205bd66b243e410f838539ce50461effb097e79e32d818cdc91a737759f8d082724a8c97ef8e8ecaef686cd7a7d7bc6d91fa79cfe1c8e1ec9b005e92

  • SSDEEP

    98304:uloNCit2Gx9KZbHKlK3p+z+2/PQgi10pBPc26+q:0ocit2Gxe8KunQgi1uPyT

  Score

  10^/10

  ffdroiderspywarestealer

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider

  • FFDroider payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2