General

  • Target

    18223614090e71027f3c60a6a4b491ec

  • Size

    953KB

  • Sample

    231221-2l9casghg5

  • MD5

    18223614090e71027f3c60a6a4b491ec

  • SHA1

    643270b3f8ab8299410f0c504caa5fa830d0a862

  • SHA256

    f3d37397b2e2a9f7b4099be69b393fa099fcf7dbb6adc4922bc86795a6b83664

  • SHA512

    34de120da1e760a62fbe8298dc71c5ef6552fbeb0179caa0da6d3c75d229841e5212be5a0e05fe66ca22e4f6cbd9f57d607ecb1e8ad01de836050967634f2eb9

  • SSDEEP

    12288:j9lBnqfZiMym1/4jGiO0J0wCzDvcBqKJZHDBCyMAFokoczTwphpa7coWQ12kfTwC:5lBapymaawC/xKHHdCDVkoIwxylvUC

Malware Config

Extracted

Family

ffdroider

C2

http://186.2.171.3

Targets

    • Target

      18223614090e71027f3c60a6a4b491ec

    • Size

      953KB

    • MD5

      18223614090e71027f3c60a6a4b491ec

    • SHA1

      643270b3f8ab8299410f0c504caa5fa830d0a862

    • SHA256

      f3d37397b2e2a9f7b4099be69b393fa099fcf7dbb6adc4922bc86795a6b83664

    • SHA512

      34de120da1e760a62fbe8298dc71c5ef6552fbeb0179caa0da6d3c75d229841e5212be5a0e05fe66ca22e4f6cbd9f57d607ecb1e8ad01de836050967634f2eb9

    • SSDEEP

      12288:j9lBnqfZiMym1/4jGiO0J0wCzDvcBqKJZHDBCyMAFokoczTwphpa7coWQ12kfTwC:5lBapymaawC/xKHHdCDVkoIwxylvUC

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • FFDroider payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks