General

  • Target

    3e597b87ad12c56de3b3d98fd2e1c7c1c4671c343d3ed133abe256c1253633c9

  • Size

    924KB

  • Sample

    231028-vavw7sea44

  • MD5

    89117af172cb15304e2bd54cdb8192dd

  • SHA1

    062b73253338e67d88abb61a3dfc6d397c4460f6

  • SHA256

    3e597b87ad12c56de3b3d98fd2e1c7c1c4671c343d3ed133abe256c1253633c9

  • SHA512

    db8bddb0a9e9416955cbee9db9bc4f11390d5b18f3fce6bb4632edc335a89b6240d60eb5f4f0592bc87a94021b97dcdeda6710a1e7c25880683dd77f91eab8b2

  • SSDEEP

    24576:pP7A681d48vGlldFtqFbDNaYaPCQFXVDXE4IfmDWQx:pzF8I8vGbdFtabDNUPCQFXVDXvdDWQx

Malware Config

Extracted

Family

ffdroider

C2

http://186.2.171.3

Targets

    • Target

      3e597b87ad12c56de3b3d98fd2e1c7c1c4671c343d3ed133abe256c1253633c9

    • Size

      924KB

    • MD5

      89117af172cb15304e2bd54cdb8192dd

    • SHA1

      062b73253338e67d88abb61a3dfc6d397c4460f6

    • SHA256

      3e597b87ad12c56de3b3d98fd2e1c7c1c4671c343d3ed133abe256c1253633c9

    • SHA512

      db8bddb0a9e9416955cbee9db9bc4f11390d5b18f3fce6bb4632edc335a89b6240d60eb5f4f0592bc87a94021b97dcdeda6710a1e7c25880683dd77f91eab8b2

    • SSDEEP

      24576:pP7A681d48vGlldFtqFbDNaYaPCQFXVDXE4IfmDWQx:pzF8I8vGbdFtabDNUPCQFXVDXvdDWQx

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • FFDroider payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks