ffdroider | 31258b05ab44755b1fb76431c44b4a9484f8620e586eb1c931ba82097c788dcd

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/03/2026, 16:52

Target
2026-03-22_db9733eab8ba98adce95e9a009bf4e62_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 1.0MB
Sample260322-vdf78afv4k
SHA256 31258b05ab44755b1fb76431c44b4a9484f8620e586eb1c931ba82097c788dcd
MD5 db9733eab8ba98adce95e9a009bf4e62
SHA1 88b46e5da2be0d4981b183fe13102fe84f106d06
SHA512 844765b51a8d52a6e4080224e13c88bc96f7a7c55ccd7cf8f67fe24e87ff43d10a1bd4560872431d5593c3585ea769f29abd91f920ea041e77d4ae8c60ebf1ac
SSDEEP 24576:1yGRRghW/idxBovnAoQ42GdqDXAU8+2zSBhAudA7c6o2uOxvDRBM:pRRUW6dHoEl7DQUPA7cJOtlBM
TLSH
T1CB35CF52B5E3E071C52241B04A7CEB566EBDBD3108379BAF67D8191C2E348C0DB29B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ffdroider stealer

Family

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider
Ffdroider family
ffdroider

Custom signature

Detects executables built or packed with MPress PE compressor 1 IoCs

resource	yara_rule
behavioral2/memory/4288-0-0x0000000000400000-0x000000000050D000-memory.dmp	INDICATOR_EXE_Packed_MPress

Program crash 1 IoCs

pid	pid_target	Process	procid_target
464	4288	WerFault.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-03-22_db9733eab8ba98adce95e9a009bf4e62_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-22_db9733eab8ba98adce95e9a009bf4e62_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
PID:4288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 8
  2⤵
  - Program crash
  PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4288 -ip 4288
1⤵
PID:3964

memory/4288-0-0x0000000000400000-0x000000000050D000-memory.dmp

Download