Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The FileFiend binaries, named by Gambit Security in their original report, appear under the decoy filename Exchangedb.exe, distributed across five victim subdirectories under the metro/ folder structure.
The FileFiend binaries, named by Gambit Security in their original report, appear under the decoy filename Exchangedb.exe, distributed across five victim subdirectories under the metro/ folder structure.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Mapping Technique ID Name Evidence T1005 Data from Local System Collected data included database backups, PST email files, configuration files, and exported credentials from victim systems.
“They also deployed a bespoke C++ tool internally named FileFiend that could enumerate local drives and SMB shares and send files to a hardcoded server.”
The binary could enumerate local drives and SMB shares, walk the file system, and send files to a hard-coded C2 [command-and-control] server.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom uploader/exfiltration malware used in the Ababil of Minab campaign. It was disguised as Exchangedb.exe and used to automatically enumerate local drives and SMB network shares for data collection, including PST files and other sensitive data.
A bespoke C++ data theft tool used to enumerate local drives and SMB shares and exfiltrate files to a hardcoded server.
A bespoke C++ file collection and exfiltration tool that can enumerate local drives and SMB shares, traverse the file system, and send files to a hard-coded command-and-control server.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.