General

  • Target

    38b2c7a1af454d382927f81543d86055886bc028634575050367d052efd26434

  • Size

    1.1MB

  • Sample

    221022-r1lvfadgep

  • MD5

    78c42d6817af1ad96cabdf6ff2f7f3da

  • SHA1

    abeadcee8d9f00c6ccdb0f9d33edd1006a079384

  • SHA256

    38b2c7a1af454d382927f81543d86055886bc028634575050367d052efd26434

  • SHA512

    76a3b3e6ae0ea0f17661314fe391ec8b9b580a7ecfee0ebe2d830db3843d5d929d6bf3adb8cb03f6b87212a607ce001700ea3dc305828c817ff017dd3b766811

  • SSDEEP

    24576:zmWAbXH84DRnKCwyElWCAMmKix1x1IDStOX2cBZ8umx7QgbcxWsG2:zmXL8uokzK6DxcD8uqzbcxWX

Malware Config

Extracted

Family

ffdroider

C2

http://103.136.42.153

Targets

    • Target

      38b2c7a1af454d382927f81543d86055886bc028634575050367d052efd26434

    • Size

      1.1MB

    • MD5

      78c42d6817af1ad96cabdf6ff2f7f3da

    • SHA1

      abeadcee8d9f00c6ccdb0f9d33edd1006a079384

    • SHA256

      38b2c7a1af454d382927f81543d86055886bc028634575050367d052efd26434

    • SHA512

      76a3b3e6ae0ea0f17661314fe391ec8b9b580a7ecfee0ebe2d830db3843d5d929d6bf3adb8cb03f6b87212a607ce001700ea3dc305828c817ff017dd3b766811

    • SSDEEP

      24576:zmWAbXH84DRnKCwyElWCAMmKix1x1IDStOX2cBZ8umx7QgbcxWsG2:zmXL8uokzK6DxcD8uqzbcxWX

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks