Extracted

• • Target

    8b334bca600acc9630ad54bd3a942391

  • Size

    6.1MB

  • MD5

    8b334bca600acc9630ad54bd3a942391

  • SHA1

    04a52ad3b01f535f6d3df9151a415f1ed8afbc9e

  • SHA256

    ed60315ceda29939209fca009b94888abaa3662c4473ae42c5a73b6a0e4bf620

  • SHA512

    000c5a801c446b71dc8c54540064e48e2d682b873f984c4cef06a05e57a2d813fdb8c348c35c9794fe7fc1ab4ef651e7ec6df38e6dc9032682836e2a0e35ec95

  • SSDEEP

    98304:pAI+u4UsuNxyflztzvp44Z+9uhJP1ZAxXNxAMg7HCM7wVhOAn0tq++13F+/GzUJg:ituJsuNxwlzFvtZ+Ybw2hOEPPeYJDGf

  Score

  10^/10

  ffdroiderraccoondiscoverypersistencestealervmprotectspyware

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider

  • FFDroider payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2