ffdroider

General

Target

8b334bca600acc9630ad54bd3a942391
Size

6.1MB
Sample

240203-dafc3sfcb9
MD5

8b334bca600acc9630ad54bd3a942391
SHA1

04a52ad3b01f535f6d3df9151a415f1ed8afbc9e
SHA256

ed60315ceda29939209fca009b94888abaa3662c4473ae42c5a73b6a0e4bf620
SHA512

000c5a801c446b71dc8c54540064e48e2d682b873f984c4cef06a05e57a2d813fdb8c348c35c9794fe7fc1ab4ef651e7ec6df38e6dc9032682836e2a0e35ec95
SSDEEP

98304:pAI+u4UsuNxyflztzvp44Z+9uhJP1ZAxXNxAMg7HCM7wVhOAn0tq++13F+/GzUJg:ituJsuNxwlzFvtZ+Ybw2hOEPPeYJDGf

Score

10^/10

Malware Config

Extracted

Family

ffdroider

C2

http://186.2.171.3

Targets

- Target
  
  8b334bca600acc9630ad54bd3a942391
- Size
  
  6.1MB
- MD5
  
  8b334bca600acc9630ad54bd3a942391
- SHA1
  
  04a52ad3b01f535f6d3df9151a415f1ed8afbc9e
- SHA256
  
  ed60315ceda29939209fca009b94888abaa3662c4473ae42c5a73b6a0e4bf620
- SHA512
  
  000c5a801c446b71dc8c54540064e48e2d682b873f984c4cef06a05e57a2d813fdb8c348c35c9794fe7fc1ab4ef651e7ec6df38e6dc9032682836e2a0e35ec95
- SSDEEP
  
  98304:pAI+u4UsuNxyflztzvp44Z+9uhJP1ZAxXNxAMg7HCM7wVhOAn0tq++13F+/GzUJg:ituJsuNxwlzFvtZ+Ybw2hOEPPeYJDGf
Score

10^/10

ffdroider raccoon discovery persistence stealer vmprotect spyware
- FFDroider
  Stealer targeting social media platform users first seen in April 2022.
  stealer ffdroider
- FFDroider payload
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Raccoon Stealer V1 payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2