FFDroider

The stealer signs into victims' social media platforms using stolen cookies, and extracts account information like Facebook Ads-manager to run malicious advertisements with stored payment methods.

Leverages inbound whitelisting rules in Windows Firewall allowing the malware to be copied at desired location.

The stealer signs into victims' social media platforms using stolen cookies, and extracts account information like Facebook Ads-manager to run malicious advertisements with stored payment methods.

the FFDroider stealer uses the decrypted string and RegCreateKey() function to create the registry key: “ HKCU\Software\ffdroider\FFDroider ”

the FFDroider stealer uses the decrypted string and RegCreateKey() function to create the registry key: “ HKCU\Software\ffdroider\FFDroider ”

Mitre table T1055 Process Injection

The stealer signs into victims' social media platforms using stolen cookies, and extracts account information like Facebook Ads-manager to run malicious advertisements with stored payment methods.

the FFDroider stealer uses the decrypted string and RegCreateKey() function to create the registry key: “ HKCU\Software\ffdroider\FFDroider ”

Mitre table T1027 Obfuscated Files or Information

The FFDroider stealer is packed with the popular “ASPack v2.12” packer... Mitre table T1027-002 Software Packing

FFDroider disguises itself on victim's machines to look like the instant messaging application 'Telegram.'

Mitre table T1055 Process Injection

The stealer signs into victims' social media platforms using stolen cookies, and extracts account information like Facebook Ads-manager to run malicious advertisements with stored payment methods.

Then it executes a String Decryption Routine which is basically a XOR Decryption loop amongst the encrypted string and the key

if they are restricted the IEGetProtectedModeCookie() function is been used to access low integrity cookies for all the target applications during which it launches an another process “IElowutil.exe”

the FFDroider stealer uses the decrypted string and RegCreateKey() function to create the registry key: “ HKCU\Software\ffdroider\FFDroider ”

Mitre table T1003 OS Credential Dumping

Stealers are malicious programs that threat actors use to collect sensitive information with various techniques including keylogging, cookie stealing, and sending stolen information to the Command and Control Server.

Designed to send stolen credentials and cookies to a Command & Control server... The stealer signs into victims' social media platforms using stolen cookies...

Reads and parses the Chromium SQLite Credential Store... containing the saved credentials... The password cache is fetched from the output and passed to the CryptUnProtectData() function for in memory decryption, revealing clear-text credentials | the malware plans to steal saved VPN/Dial Up credentials from the \Appdata\Microsoft\Network\Connections\Pbk\rasphone.pbk & \Pbk\rasphone.pbk if present

The FFDroider Stealer steals and parses the cookies from the Firefox browser initially by reading the profiles.ini... uses those profile names to access SQLite cookie stores named: “cookies.sqlite” | The FFDroider steals cookies and saved login credentials for the Chrome browser... reads and parses the Chromium SQLite Credential Store... containing the saved credentials

Mitre table T1016 System Network Configuration Discovery

Mitre table T1018 Remote System Discovery

Mitre table T1057 Process Discovery

Mitre table T1082 System Information Discovery

Mitre table T1083 File and Directory Discovery

Mitre table T1005 Data from Local System

Stealers are malicious programs that threat actors use to collect sensitive information with various techniques including keylogging, cookie stealing, and sending stolen information to the Command and Control Server.

Designed to send stolen credentials and cookies to a Command & Control server, FFDroider disguises itself on victim's machines to look like the instant messaging application 'Telegram.'

An initial GET request is sent to the Command & Control Server... Then the malware sends an HTTP POST request to the C2 server

The FFDroider Stealer further it tries to upgrade itself in a fixed interval of time by downloading other modules from an update server

Then the malware sends an HTTP POST request to the C2 server... along with the encrypted cache of data for exfiltration.

Also an inbound whitelisting rule in the Windows Firewall... which requires administrative privileges.