ffdroider | b1209191392de48946828e01f2c44c1fb38c09c89425327b29fdcfb1c4dfa566

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

138610cf962ab62eb32d222a4a35b93a_JaffaCakes118.exe
Size

2.1MB
MD5

138610cf962ab62eb32d222a4a35b93a
SHA1

7348ff4e3894610a51e7d87a10500455f535c7e3
SHA256

b1209191392de48946828e01f2c44c1fb38c09c89425327b29fdcfb1c4dfa566
SHA512

c17f4235964de9de8333e21f10c47d7b36df15ea980b39b7e659d762b18a083fb62964a53cb9ed92cec3c2da71b09a66a2d4a2d11a77b93e15278f569fa1ee69
SSDEEP

49152:HQwudv0Z+VSX+DYS7jOtIE3Ft4mZtrWiU/mg6Yqs:ww+Icmmp7jOtIEVtBvPIgs

Score

10^/10

ffdroider spyware stealer

Malware Config

Extracted

Family

ffdroider

http://186.2.171.3

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2372-20-0x0000000000400000-0x0000000000991000-memory.dmp	family_ffdroider
behavioral1/memory/2372-40-0x0000000000400000-0x0000000000991000-memory.dmp	family_ffdroider

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

138610cf962ab62eb32d222a4a35b93a_JaffaCakes118.exe

description pid process

Token: SeManageVolumePrivilege 2372 138610cf962ab62eb32d222a4a35b93a_JaffaCakes118.exe

description	pid	process
Token: SeManageVolumePrivilege	2372	138610cf962ab62eb32d222a4a35b93a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\138610cf962ab62eb32d222a4a35b93a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\138610cf962ab62eb32d222a4a35b93a_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-0-0x0000000000400000-0x0000000000991000-memory.dmp

Filesize
5.6MB

Download
memory/2372-1-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2372-20-0x0000000000400000-0x0000000000991000-memory.dmp

Filesize
5.6MB

Download
memory/2372-24-0x0000000003AB0000-0x0000000003AC0000-memory.dmp

Filesize
64KB

Download
memory/2372-30-0x0000000003C50000-0x0000000003C60000-memory.dmp

Filesize
64KB

Download
memory/2372-40-0x0000000000400000-0x0000000000991000-memory.dmp

Filesize
5.6MB

Download