General

  • Target

    3596982adf10806e7128f8f64621ec7546f4c56e445010523a1a5a584254f786.bin

  • Size

    1.9MB

  • Sample

    220730-ebadwsgddm

  • MD5

    6a235ccfd5dd5e47d299f664d03652b7

  • SHA1

    75825ab1b4db3c5e41a17c98394c46d02f766b5a

  • SHA256

    3596982adf10806e7128f8f64621ec7546f4c56e445010523a1a5a584254f786

  • SHA512

    3abbfcbf43daf58c7a8b3a148f251fdf09acea63418481e6a6d7562a4d7bb2dace784aec5839f55737cff0ca83e6c457546a1d49ae361af8e20fea14391b79f8

  • SSDEEP

    49152:woSsL+Ax4UH/9LEnzjMdtCd1U9zfb/niBBk+QqX0NmXqxRx:/Iu/mnzwA1U9X/niB3Xg

Malware Config

Extracted

Family

ffdroider

C2

http://152.32.228.19

Targets

    • Target

      3596982adf10806e7128f8f64621ec7546f4c56e445010523a1a5a584254f786.bin

    • Size

      1.9MB

    • MD5

      6a235ccfd5dd5e47d299f664d03652b7

    • SHA1

      75825ab1b4db3c5e41a17c98394c46d02f766b5a

    • SHA256

      3596982adf10806e7128f8f64621ec7546f4c56e445010523a1a5a584254f786

    • SHA512

      3abbfcbf43daf58c7a8b3a148f251fdf09acea63418481e6a6d7562a4d7bb2dace784aec5839f55737cff0ca83e6c457546a1d49ae361af8e20fea14391b79f8

    • SSDEEP

      49152:woSsL+Ax4UH/9LEnzjMdtCd1U9zfb/niBBk+QqX0NmXqxRx:/Iu/mnzwA1U9X/niB3Xg

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • FFDroider payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks