General

  • Target

    16ed7e7725384b25d7591fb35088b367e6062673ee2c80d7fa0808e8d1ebfb05

  • Size

    1.3MB

  • Sample

    230129-zx6dnsch76

  • MD5

    3473191d876e4f97ea9a8f84b6e65e0f

  • SHA1

    e5eb5169f57400194c5beecb106570689786e68b

  • SHA256

    16ed7e7725384b25d7591fb35088b367e6062673ee2c80d7fa0808e8d1ebfb05

  • SHA512

    effc568be67b5a9c84a8357103eb4fb846517ba04d2eedf4d69c6f7b73650c427a23c785c21b6d1e8aada5a4d31d73e91eeaeb0974ea39dcb8b056dd52f0fe48

  • SSDEEP

    24576:2cURbdngEBJKuumfsEOJrpDI6mUfdRiETmqWVS6ZShnakTufpnBnkqrXepgfVYyq:2cURpgmJBr+JVIsdRi/MYRBnky3VRq

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Targets

    • Target

      16ed7e7725384b25d7591fb35088b367e6062673ee2c80d7fa0808e8d1ebfb05

    • Size

      1.3MB

    • MD5

      3473191d876e4f97ea9a8f84b6e65e0f

    • SHA1

      e5eb5169f57400194c5beecb106570689786e68b

    • SHA256

      16ed7e7725384b25d7591fb35088b367e6062673ee2c80d7fa0808e8d1ebfb05

    • SHA512

      effc568be67b5a9c84a8357103eb4fb846517ba04d2eedf4d69c6f7b73650c427a23c785c21b6d1e8aada5a4d31d73e91eeaeb0974ea39dcb8b056dd52f0fe48

    • SSDEEP

      24576:2cURbdngEBJKuumfsEOJrpDI6mUfdRiETmqWVS6ZShnakTufpnBnkqrXepgfVYyq:2cURpgmJBr+JVIsdRi/MYRBnky3VRq

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks