General

  • Target

    2428300eaca9fcd5d2170b811a464b4591e9391ea57e95fa217b02d3328e7419

  • Size

    474KB

  • Sample

    230129-wbpl9afh42

  • MD5

    95ce031c5273b6c1f2d813566a7ea9ea

  • SHA1

    f47a1a1502de7a0b9cae47037e06f41753d94156

  • SHA256

    2428300eaca9fcd5d2170b811a464b4591e9391ea57e95fa217b02d3328e7419

  • SHA512

    5a2fa3a7413c672714d38b6d60e5794481c871ba402f92bc97a6e37b7fed466212060a8d7a560a900c8637ab6b39d8c619fc528d5ec8e303fd98efd89db57cdc

  • SSDEEP

    12288:pvv0rmiMQTll4pWWUgyOHaW8xAyBhh4YIRRioMZtKOIiVywxGkoS:Bd2ll4XZGxAyBbrCeVIkywx

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Targets

    • Target

      2428300eaca9fcd5d2170b811a464b4591e9391ea57e95fa217b02d3328e7419

    • Size

      474KB

    • MD5

      95ce031c5273b6c1f2d813566a7ea9ea

    • SHA1

      f47a1a1502de7a0b9cae47037e06f41753d94156

    • SHA256

      2428300eaca9fcd5d2170b811a464b4591e9391ea57e95fa217b02d3328e7419

    • SHA512

      5a2fa3a7413c672714d38b6d60e5794481c871ba402f92bc97a6e37b7fed466212060a8d7a560a900c8637ab6b39d8c619fc528d5ec8e303fd98efd89db57cdc

    • SSDEEP

      12288:pvv0rmiMQTll4pWWUgyOHaW8xAyBhh4YIRRioMZtKOIiVywxGkoS:Bd2ll4XZGxAyBbrCeVIkywx

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks