ffdroider | 2025-12-18_5c480b9b6ee16832d25b54cc1c83f25d_coinminer_elex_glassworm_maze_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2025-12-18_5c480b9b6ee16832d25b54cc1c83f25d_coinminer_elex_glassworm_maze_stealc
Size 2.0MB
Sample251218-lsv59askes
SHA256 472eb658a4702eab3c579ddf1cafa16cb9e8594e352934af1ce4730cfd174281
MD5 5c480b9b6ee16832d25b54cc1c83f25d
SHA1 8f597d19c8e3ed1a47c701609c00094b8d8c4e34
SHA512 9f79ed5f500eaf72be7e8181a3bad25874274b0d4ddf4ae4313eda90fad7ae19854e4b8383d593681e88a56a01ffc5e01d2791453a9d6645fca5be956e1c2e9f
SSDEEP 49152:1FKiiycOoSr6blxHbAjOLNct3oY/DavQ/qpyr0kncvK9dlGZAPRL+I:iiiycOoSr6blxHYuNctXbavQ/qpyr0ky
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ffdroider

Malware Config

Extracted

Family

ffdroider

http://186.2.171.3

Signatures

FFDroider payload 1 IoCs

resource	yara_rule
sample	family_ffdroider

Ffdroider family
ffdroider

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-12-18_5c480b9b6ee16832d25b54cc1c83f25d_coinminer_elex_glassworm_maze_stealc

File Explorer

2025-12-18_5c480b9b6ee16832d25b54cc1c83f25d_coinminer_elex_glassworm_maze_stealc

.exe 2.0MB

2025-12-18_5c480b9b6ee16832d25b54cc1c83f25d_coinminer_elex_glassworm_maze_stealc

IMPHASH 1bc4107ca28e0dfba96f1fce788e49e6
SHA256 472eb658a4702eab3c579ddf1cafa16cb9e8594e352934af1ce4730cfd174281
MD5 5c480b9b6ee16832d25b54cc1c83f25d
SHA1 8f597d19c8e3ed1a47c701609c00094b8d8c4e34
SHA512 9f79ed5f500eaf72be7e8181a3bad25874274b0d4ddf4ae4313eda90fad7ae19854e4b8383d593681e88a56a01ffc5e01d2791453a9d6645fca5be956e1c2e9f
SSDEEP 49152:1FKiiycOoSr6blxHbAjOLNct3oY/DavQ/qpyr0kncvK9dlGZAPRL+I:iiiycOoSr6blxHYuNctXbavQ/qpyr0ky
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

FFDroider payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

632694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

LoadLibraryW VirtualQuery GetCurrentProcess GetCurrentProcessId CreateThread TerminateThread WaitForSingleObject GetFileSize WriteFile CloseHandle CreateMutexW GetModuleFileNameA GetModuleFileNameW GetModuleHandleW OutputDebugStringA GetSystemDirectoryW CreateDirectoryW CreateFileW CopyFileW GetVolumeInformationW ReadFile LoadLibraryExW CreateFileA FindFirstFileW FindNextFileW WideCharToMultiByte GetExitCodeThread Sleep EnterCriticalSection LeaveCriticalSection SetEndOfFile SetFilePointer GetTickCount DeleteFileW OutputDebugStringW TerminateProcess DeleteFileA AreFileApisANSI GetSystemTime LocalFree GetTempPathA GetVersionExA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingW CreateFileMappingA GetDiskFreeSpaceW LockFileEx GetTempPathW FlushFileBuffers GetFileAttributesW HeapValidate HeapCreate GetFileAttributesA GetVersionExW FormatMessageW FormatMessageA GetSystemTimeAsFileTime UnlockFileEx WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile InterlockedCompareExchange QueryPerformanceCounter SystemTimeToFileTime UnmapViewOfFile MapViewOfFile HeapCompact GetFullPathNameA GetFullPathNameW GetCurrentThreadId InitializeCriticalSection TryEnterCriticalSection InterlockedDecrement UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead FreeLibrary MultiByteToWideChar GetPrivateProfileStringW FindResourceExW ReleaseSemaphore DuplicateHandle VirtualProtect VirtualFree VirtualAlloc GetModuleHandleA FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait SetEvent CreateTimerQueue FindResourceW LoadLibraryA SizeofResource LoadResource GetProcAddress LockResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException GetProcessHeap HeapSize LoadLibraryExA GetStringTypeW EncodePointer IsDebuggerPresent SetLastError GetCurrentThread GetThreadTimes RtlUnwind IsProcessorFeaturePresent GetCPInfo ExitThread GetTimeZoneInformation GetCommandLineW UnhandledExceptionFilter SetUnhandledExceptionFilter CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW CreateSemaphoreW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleCP GetConsoleMode GetFileType ReadConsoleW SetFilePointerEx SetConsoleCtrlHandler SetEnvironmentVariableW SetStdHandle WriteConsoleW SetEnvironmentVariableA lstrlenA DeleteFiber GlobalMemoryStatus ConvertFiberToThread GetEnvironmentVariableW ReadConsoleA SetConsoleMode HeapFree HeapReAlloc HeapAlloc HeapDestroy DecodePointer

user32

MessageBoxW GetProcessWindowStation wsprintfA GetDesktopWindow GetUserObjectInformationW

advapi32

RegCloseKey CryptReleaseContext DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW RegQueryValueExW RegOpenKeyExW CryptGenRandom

shell32

SHGetFolderPathA SHGetSpecialFolderPathW

ole32

CoCreateInstance OleRun CoInitializeEx

ws2_32

WSASetLastError send recv WSAGetLastError WSACleanup WSAStartup closesocket

shlwapi

PathFileExistsW

winhttp

WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryAuthSchemes WinHttpSetCredentials WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpSetOption WinHttpSetStatusCallback WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest

quartz

AMGetErrorTextW