ffdroider | 7b1cf1979579775f48e8d20974753453f75963b3094d3b95519d9362e943dbbb

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

md3_3kvm.exe
Size

924KB
MD5

53b01ccd65893036e6e73376605da1e2
SHA1

12c7162ea3ce90ec064ce61251897c8bec3fd115
SHA256

de95d03777407422fac23d6c1f0740e131a0d38c5ef19aca742c7bcf1a994fd7
SHA512

e5d1dd0ac1a53df261179d58817e71f4b263179ba1f1599da3b654ae9550dc608afc5a12057fb533aab0abb2eb406e3a7331e10a6f2b91254f062a777299e067
SSDEEP

24576:pP7A681d48vGlldFtqFbDNaYaPCQFXVDXE4IfmDWQ:pzF8I8vGbdFtabDNUPCQFXVDXvdDWQ

Score

10^/10

ffdroider spyware stealer

Malware Config

Extracted

Family

ffdroider

http://186.2.171.3

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider payload 3 IoCs

Processes:

resource	yara_rule
behavioral23/memory/2632-19-0x0000000000400000-0x000000000062C000-memory.dmp	family_ffdroider
behavioral23/memory/2632-35-0x0000000000400000-0x000000000062C000-memory.dmp	family_ffdroider
behavioral23/memory/2632-40-0x0000000000400000-0x000000000062C000-memory.dmp	family_ffdroider

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

md3_3kvm.exe

description pid process

Token: SeManageVolumePrivilege 2632 md3_3kvm.exe

description	pid	process
Token: SeManageVolumePrivilege	2632	md3_3kvm.exe

C:\Users\Admin\AppData\Local\Temp\md3_3kvm.exe
"C:\Users\Admin\AppData\Local\Temp\md3_3kvm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab4B16.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
memory/2632-1-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2632-0-0x0000000000400000-0x000000000062C000-memory.dmp

Filesize
2.2MB

Download
memory/2632-19-0x0000000000400000-0x000000000062C000-memory.dmp

Filesize
2.2MB

Download
memory/2632-21-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2632-23-0x00000000027C0000-0x00000000027D0000-memory.dmp

Filesize
64KB

Download
memory/2632-29-0x00000000034C0000-0x00000000034D0000-memory.dmp

Filesize
64KB

Download
memory/2632-35-0x0000000000400000-0x000000000062C000-memory.dmp

Filesize
2.2MB

Download
memory/2632-40-0x0000000000400000-0x000000000062C000-memory.dmp

Filesize
2.2MB

Download