Overview

overview

10

Static

static

7

d7eb620404...e3.exe

windows7-x64

10

d7eb620404...e3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d7eb620404874d7f77870f1b1ecaeee3

  • Size

    758KB

  • Sample

    240320-fdypyagh52

  • MD5

    d7eb620404874d7f77870f1b1ecaeee3

  • SHA1

    e281d765ee3facac0140732427c291f1a31d90b4

  • SHA256

    1dce5d2a9682c811f7c4dd7e4f4c8f26ba35bba8803efe316aabddafb41c1708

  • SHA512

    5042740a5f8d650cdce19b07eb45896dac5b76c853a60158b4c09ddbf83f3463ba6789dc93357aad18343add3a84e1e518c9511e0bc1af16ff16966007ad4bb8

  • SSDEEP

    12288:AfZMnJxs7QUxOwR8s3AYxHHu90MnJ33Px1MKU2GLcOPSv8AQv8JyWOOFPDGMi4:AfZMg7QXw2sQYtuHJHpORncOKv8TTWNM

Score
10/10
ffdroiderevasionspywarestealertrojanvmprotect

Malware Config

Extracted

Family

ffdroider

C2

http://128.1.32.84

Targets

    • Target

      d7eb620404874d7f77870f1b1ecaeee3

    • Size

      758KB

    • MD5

      d7eb620404874d7f77870f1b1ecaeee3

    • SHA1

      e281d765ee3facac0140732427c291f1a31d90b4

    • SHA256

      1dce5d2a9682c811f7c4dd7e4f4c8f26ba35bba8803efe316aabddafb41c1708

    • SHA512

      5042740a5f8d650cdce19b07eb45896dac5b76c853a60158b4c09ddbf83f3463ba6789dc93357aad18343add3a84e1e518c9511e0bc1af16ff16966007ad4bb8

    • SSDEEP

      12288:AfZMnJxs7QUxOwR8s3AYxHHu90MnJ33Px1MKU2GLcOPSv8AQv8JyWOOFPDGMi4:AfZMg7QXw2sQYtuHJHpORncOKv8TTWNM

    Score
    10/10
    ffdroiderstealervmprotectevasionspywaretrojan

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

      stealerffdroider

    • FFDroider payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks