Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-03-2024 12:32
General
-
Target
ce11de1000560d312bf6ab0b5327e87b.exe
-
Size
829KB
-
MD5
ce11de1000560d312bf6ab0b5327e87b
-
SHA1
557f3f780cb0f694887ada330a87ba976cdb168f
-
SHA256
126daa976d1eaec1bd68eb53748caa325fc537f865051dd0d5f09d599175861a
-
SHA512
655b45bcf75a79c174caf6fae84560980511d068f67a89883f70b264e88983f729c604b3484fdcb8d8f8a83105e43d740fe70e7a006806136bc423453d769655
-
SSDEEP
24576:+Fm+gA9AW4k++iO31ad4uOcpg/SPvFLI6:3+gA9AW4bkTujZvF
Score
10/10
Malware Config
Extracted
Family
ffdroider
C2
http://152.32.151.93
Signatures
-
FFDroider
Stealer targeting social media platform users first seen in April 2022.
-
FFDroider payload 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce11de1000560d312bf6ab0b5327e87b.exe"C:\Users\Admin\AppData\Local\Temp\ce11de1000560d312bf6ab0b5327e87b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
-
Filesize
12KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.3MB