ffdroider

General

Target

2024-10-19_8f95d249a8940a86f0518d676cfc3096_derusbi_lockbit_wannacry
Size

4.5MB
Sample

241019-lzlv6azepb
MD5

8f95d249a8940a86f0518d676cfc3096
SHA1

ac3c91f89d4fca14410e24bd348ced70891b543a
SHA256

d0b41ed9435129ccdf1bf7ca87fa4b33649b5b924d8cdbc12966d33fb7b9b873
SHA512

21e8fe5d0f2e2e9ea36a7ea5fc0230a9ac3657528f93ad9b83ef9895fccf2563ecc8f6115a625c60ca8581e6bc043a3a6560a50d650476676bf8c391975e1a82
SSDEEP

24576:HgIWd8sPeH6qAoIqEU502aM56PemUnJNhxtP+AmUmey2s73tOOu55E9QiwzTUBUD:id8gez+AmUvy2s7s5e9QiE

Score

10^/10

Malware Config

Targets

- Target
  
  2024-10-19_8f95d249a8940a86f0518d676cfc3096_derusbi_lockbit_wannacry
- Size
  
  4.5MB
- MD5
  
  8f95d249a8940a86f0518d676cfc3096
- SHA1
  
  ac3c91f89d4fca14410e24bd348ced70891b543a
- SHA256
  
  d0b41ed9435129ccdf1bf7ca87fa4b33649b5b924d8cdbc12966d33fb7b9b873
- SHA512
  
  21e8fe5d0f2e2e9ea36a7ea5fc0230a9ac3657528f93ad9b83ef9895fccf2563ecc8f6115a625c60ca8581e6bc043a3a6560a50d650476676bf8c391975e1a82
- SSDEEP
  
  24576:HgIWd8sPeH6qAoIqEU502aM56PemUnJNhxtP+AmUmey2s73tOOu55E9QiwzTUBUD:id8gez+AmUvy2s7s5e9QiE
Score

10^/10

ffdroider jupyter maze backdoor discovery evasion ransomware spyware stealer trojan persistence privilege_escalation
- FFDroider
  Stealer targeting social media platform users first seen in April 2022.
  stealer ffdroider
- Jupyter, SolarMarker
  Jupyter is a backdoor and infostealer first seen in mid 2020.
  backdoor trojan stealer jupyter
- Maze
  Ransomware family also known as ChaCha.
  trojan ransomware maze
- Modifies security service
  evasion
- Modifies visibility of file extensions in Explorer
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2