Extracted

• • Target

    dcd0da0e2a4791de9578d997e9022710e9c88414c4421a95988897b61e4841ba

  • Size

    4.3MB

  • MD5

    3aa667aff44754cd87a6eb4cb347a91b

  • SHA1

    1013d521a4b5f6a5e1a39773c0cdb9364a0ae618

  • SHA256

    dcd0da0e2a4791de9578d997e9022710e9c88414c4421a95988897b61e4841ba

  • SHA512

    a392b44659e052edf0b027648eea2b69a6043c1eb4bdc4f38c1310dfb86c0f8e950329a7e89ace02f1c331189786c0adb0eec328dba4ac62aca595922c3e6238

  • SSDEEP

    98304:iL5LNYSnH/qy3N5MFRa1wR+ByBQJTWCsizJHaDi6FkEXV9D527BWG:iLxLHI21wR3BQTWdaJHPyfDVQBWG

  Score

  10^/10

  ffdroiderdiscoveryspywarestealerevasiontrojan

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider

  • FFDroider payload

  • Ffdroider family

    ffdroider

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2