Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
22-12-2023 13:34
General
-
Target
a69cfd4ebd3e783943be08d7ffe8e05a.exe
-
Size
1.4MB
-
MD5
a69cfd4ebd3e783943be08d7ffe8e05a
-
SHA1
cd5eff3cc79f6d3e3739acf4586e787865e3c855
-
SHA256
2a0106cf867f44e349bdde8116342dbc8fe6c53c75a92328a36d79de5a08aa42
-
SHA512
0daa916629a66df6ea2ea1422cedf80718b1f207495fc51f91b71266511dd80bc7f6f23695805965d8115627ed472304a6df8d3a0d32e374987a1a8350722ebc
-
SSDEEP
24576:H8ARmK9XHkry2dvt1JpgPS8VrI+AMXqcjGEDZmGXivQ7TP4pMRR020SVFpFs4:3kK9XHkry2dV1sfJJAEVj17TwpQV0cFL
Score
10/10
Malware Config
Extracted
Family
ffdroider
C2
http://101.36.107.74
Signatures
-
FFDroider
Stealer targeting social media platform users first seen in April 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a69cfd4ebd3e783943be08d7ffe8e05a.exe"C:\Users\Admin\AppData\Local\Temp\a69cfd4ebd3e783943be08d7ffe8e05a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.4MB