ffdroider | 213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e

Sharing

Copy URL Twitter E-mail

General

Target
213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e
Size 2.2MB
Sample251217-l2a7faskhw
SHA256 213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e
MD5 ad30bd3ecf36cd7deb1724c09c0ab223
SHA1 43ad7a3b8ba99c291ba41083f5d283fcfd3a0a02
SHA512 a5a54800da296d21a849e8720b0e1dfbefe1bb214adf02630aca09e89c987b81c65d5e7c3be05ce38b65d21ca883e56692c0ba36c8c4ac0b4df5c1d970fd33da
SSDEEP 49152:BFKiiycOoSr6blxHbAjOLNct3oY/DavQ/qpyr0kncvK9dlGZAPRL+h:2iiycOoSr6blxHYuNctXbavQ/qpyr0ky
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ffdroider

Malware Config

Extracted

Family

ffdroider

http://186.2.171.3

Signatures

FFDroider payload 1 IoCs

resource	yara_rule
sample	family_ffdroider

Ffdroider family
ffdroider

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e

File Explorer

213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e

.exe 2.2MB

213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e

IMPHASH 1bc4107ca28e0dfba96f1fce788e49e6
SHA256 213092e0d6ca0c7e889606cae506fea98ae5d03d26cf17dc9237ab3cc701324e
MD5 ad30bd3ecf36cd7deb1724c09c0ab223
SHA1 43ad7a3b8ba99c291ba41083f5d283fcfd3a0a02
SHA512 a5a54800da296d21a849e8720b0e1dfbefe1bb214adf02630aca09e89c987b81c65d5e7c3be05ce38b65d21ca883e56692c0ba36c8c4ac0b4df5c1d970fd33da
SSDEEP 49152:BFKiiycOoSr6blxHbAjOLNct3oY/DavQ/qpyr0kncvK9dlGZAPRL+h:2iiycOoSr6blxHYuNctXbavQ/qpyr0ky
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

FFDroider payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

632694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

LoadLibraryW VirtualQuery GetCurrentProcess GetCurrentProcessId CreateThread TerminateThread WaitForSingleObject GetFileSize WriteFile CloseHandle CreateMutexW GetModuleFileNameA GetModuleFileNameW GetModuleHandleW OutputDebugStringA GetSystemDirectoryW CreateDirectoryW CreateFileW CopyFileW GetVolumeInformationW ReadFile LoadLibraryExW CreateFileA FindFirstFileW FindNextFileW WideCharToMultiByte GetExitCodeThread Sleep EnterCriticalSection LeaveCriticalSection SetEndOfFile SetFilePointer GetTickCount DeleteFileW OutputDebugStringW TerminateProcess DeleteFileA AreFileApisANSI GetSystemTime LocalFree GetTempPathA GetVersionExA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingW CreateFileMappingA GetDiskFreeSpaceW LockFileEx GetTempPathW FlushFileBuffers GetFileAttributesW HeapValidate HeapCreate GetFileAttributesA GetVersionExW FormatMessageW FormatMessageA GetSystemTimeAsFileTime UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange QueryPerformanceCounter SystemTimeToFileTime UnmapViewOfFile MapViewOfFile HeapCompact GetFullPathNameA GetFullPathNameW GetCurrentThreadId InitializeCriticalSection TryEnterCriticalSection InterlockedDecrement UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead FreeLibrary MultiByteToWideChar GetPrivateProfileStringW FindResourceExW ReleaseSemaphore DuplicateHandle VirtualProtect VirtualFree VirtualAlloc GetModuleHandleA FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait SetEvent CreateTimerQueue FindResourceW LoadLibraryA SizeofResource LoadResource GetProcAddress LockResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException GetProcessHeap HeapSize LoadLibraryExA GetStringTypeW EncodePointer IsDebuggerPresent SetLastError GetCurrentThread GetThreadTimes RtlUnwind IsProcessorFeaturePresent GetCPInfo ExitThread GetTimeZoneInformation GetCommandLineW UnhandledExceptionFilter SetUnhandledExceptionFilter CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW CreateSemaphoreW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleCP GetConsoleMode GetFileType ReadConsoleW SetFilePointerEx SetConsoleCtrlHandler SetEnvironmentVariableW SetStdHandle WriteConsoleW SetEnvironmentVariableA lstrlenA DeleteFiber GlobalMemoryStatus ConvertFiberToThread GetEnvironmentVariableW ReadConsoleA SetConsoleMode HeapFree HeapReAlloc HeapAlloc HeapDestroy DecodePointer

user32

MessageBoxW GetProcessWindowStation wsprintfA GetDesktopWindow GetUserObjectInformationW

advapi32

RegCloseKey CryptReleaseContext DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW RegQueryValueExW RegOpenKeyExW CryptGenRandom

shell32

SHGetFolderPathA SHGetSpecialFolderPathW

ole32

CoCreateInstance OleRun CoInitializeEx

ws2_32

WSASetLastError send recv WSAGetLastError WSACleanup WSAStartup closesocket

shlwapi

PathFileExistsW

winhttp

WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryAuthSchemes WinHttpSetCredentials WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpSetOption WinHttpSetStatusCallback WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest

quartz

AMGetErrorTextW