ffdroider | 213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20251211-en
resource tags

arch:x64arch:x86image:win11-20251211-enlocale:en-usos:windows11-21h2-x64system
submitted
17/12/2025, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e.exe
Size 2.2MB
Sample251217-l2a7faskhw
SHA256 213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e
MD5 ad30bd3ecf36cd7deb1724c09c0ab223
SHA1 43ad7a3b8ba99c291ba41083f5d283fcfd3a0a02
SHA512 a5a54800da296d21a849e8720b0e1dfbefe1bb214adf02630aca09e89c987b81c65d5e7c3be05ce38b65d21ca883e56692c0ba36c8c4ac0b4df5c1d970fd33da
SSDEEP 49152:BFKiiycOoSr6blxHbAjOLNct3oY/DavQ/qpyr0kncvK9dlGZAPRL+h:2iiycOoSr6blxHYuNctXbavQ/qpyr0ky
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery ffdroider stealer

Malware Config

Extracted

Family

ffdroider

http://186.2.171.3

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider payload 2 IoCs

resource	yara_rule
behavioral2/memory/4772-0-0x0000000000400000-0x000000000062B000-memory.dmp	family_ffdroider
behavioral2/memory/4772-1-0x0000000000400000-0x000000000062B000-memory.dmp	family_ffdroider

Ffdroider family
ffdroider

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	4772	WerFault.exe	76

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e.exe

C:\Users\Admin\AppData\Local\Temp\213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e.exe
"C:\Users\Admin\AppData\Local\Temp\213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 640
  2⤵
  - Program crash
  PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4772 -ip 4772
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4772-0-0x0000000000400000-0x000000000062B000-memory.dmp

Download

memory/4772-1-0x0000000000400000-0x000000000062B000-memory.dmp