Overview

overview

10

Static

static

10

2025-12-16...sa.exe

windows10-2004-x64

10

2025-12-16...sa.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2025-12-16_f1d425cb424a3d4d9a5487c25146668f_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_metamorfo_njrat_smoke-loader
  • Size 2.2MB
  • Sample251216-cxdmbsd14a
  • SHA256 673614ae2c2a6a41e1ed26f237fcfbbc134e7f2a8edcd7ed683f44b8388fe95a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ffdroiderdiscoverystealervmprotect

Malware Config

Extracted

Family

  • ffdroider

C2

  • http://128.1.32.84

Targets

    • Target
      2025-12-16_f1d425cb424a3d4d9a5487c25146668f_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_metamorfo_njrat_smoke-loader
    • Size 2.2MB
    • SHA256 673614ae2c2a6a41e1ed26f237fcfbbc134e7f2a8edcd7ed683f44b8388fe95a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryffdroiderstealervmprotect

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

      stealerffdroider

    • FFDroider payload

    • Ffdroider family

      ffdroider

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks