General

  • Target

    30f61f4926ad67bea2a638ff51089ed346e00a1f5de3567acd7baa4071509411

  • Size

    488KB

  • Sample

    230129-wbq53shc7v

  • MD5

    b30f832076db5ca1b840f024c57f0f53

  • SHA1

    491e72b415117f5e1962aeec385ce34a622c46e1

  • SHA256

    30f61f4926ad67bea2a638ff51089ed346e00a1f5de3567acd7baa4071509411

  • SHA512

    e0c6f8e2ffed08444c316ab26c33cccd9fcd8f12057fecfaf0ac41640ac071281fb71c19c09f5b03118097a087eaa52f1034521907743236c1822a9fe6f378d2

  • SSDEEP

    12288:Q81xs5wD9xKO0Fz6cWgvIJk1ByBS/dmRsT7uEXevYojoBCzoSH:J1iOW6W19/z+hvYs

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Targets

    • Target

      30f61f4926ad67bea2a638ff51089ed346e00a1f5de3567acd7baa4071509411

    • Size

      488KB

    • MD5

      b30f832076db5ca1b840f024c57f0f53

    • SHA1

      491e72b415117f5e1962aeec385ce34a622c46e1

    • SHA256

      30f61f4926ad67bea2a638ff51089ed346e00a1f5de3567acd7baa4071509411

    • SHA512

      e0c6f8e2ffed08444c316ab26c33cccd9fcd8f12057fecfaf0ac41640ac071281fb71c19c09f5b03118097a087eaa52f1034521907743236c1822a9fe6f378d2

    • SSDEEP

      12288:Q81xs5wD9xKO0Fz6cWgvIJk1ByBS/dmRsT7uEXevYojoBCzoSH:J1iOW6W19/z+hvYs

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks