General

  • Target

    310f9471a8f858c6b02b8c70629efebf85956a02e7fef0d55f37a2e9731aac68

  • Size

    1.2MB

  • Sample

    221130-qfbnasff9y

  • MD5

    12ed77a382b88d0def763d0b7a35cbda

  • SHA1

    e0f2bfc61e554a1c889cb49fb9a8cb605620bc26

  • SHA256

    310f9471a8f858c6b02b8c70629efebf85956a02e7fef0d55f37a2e9731aac68

  • SHA512

    c9fa3b05cc24e2f6815b01b76def6016a4cef9ca3cb389edb3bc790ce4639324987771ec2141e58afe0d641871656a7f2c46c8c6da1972177ce3a0c3810203f0

  • SSDEEP

    24576:dOJE8pMemVlorMQS4ePb27twmZ1+ROYDj4hKR/xYtFDIdIfVnXxPxT:dtvemVgMQplThKR/x8IdgnX/T

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Targets

    • Target

      310f9471a8f858c6b02b8c70629efebf85956a02e7fef0d55f37a2e9731aac68

    • Size

      1.2MB

    • MD5

      12ed77a382b88d0def763d0b7a35cbda

    • SHA1

      e0f2bfc61e554a1c889cb49fb9a8cb605620bc26

    • SHA256

      310f9471a8f858c6b02b8c70629efebf85956a02e7fef0d55f37a2e9731aac68

    • SHA512

      c9fa3b05cc24e2f6815b01b76def6016a4cef9ca3cb389edb3bc790ce4639324987771ec2141e58afe0d641871656a7f2c46c8c6da1972177ce3a0c3810203f0

    • SSDEEP

      24576:dOJE8pMemVlorMQS4ePb27twmZ1+ROYDj4hKR/xYtFDIdIfVnXxPxT:dtvemVgMQplThKR/x8IdgnX/T

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks