General

  • Target

    560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f

  • Size

    488KB

  • Sample

    220725-gredwshff7

  • MD5

    e5770e11e313cb8802bbf0e001f49ee9

  • SHA1

    94f88a6d416036a4d2cb155774ec0c1f70473a02

  • SHA256

    560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f

  • SHA512

    a766e7863c09a145259c17e7d9c6f3065567ba96e9c527ffb9fb23bd7b216f6c537b81a678cc14877ccfee6279fd4055adce1f9fe8ff9e7207ac4dd05bd75cd1

  • SSDEEP

    12288:Ivp+HbZN4SZaOdRrtr/5C4THvWDzVlJCSk6w:6puZPZaOdRrpCD5mSvw

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Targets

    • Target

      560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f

    • Size

      488KB

    • MD5

      e5770e11e313cb8802bbf0e001f49ee9

    • SHA1

      94f88a6d416036a4d2cb155774ec0c1f70473a02

    • SHA256

      560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f

    • SHA512

      a766e7863c09a145259c17e7d9c6f3065567ba96e9c527ffb9fb23bd7b216f6c537b81a678cc14877ccfee6279fd4055adce1f9fe8ff9e7207ac4dd05bd75cd1

    • SSDEEP

      12288:Ivp+HbZN4SZaOdRrtr/5C4THvWDzVlJCSk6w:6puZPZaOdRrpCD5mSvw

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks