General

  • Target

    135cde4f3fdb52b79380a7e7da9f0c30_JaffaCakes118

  • Size

    2.1MB

  • Sample

    240329-adk6ysch26

  • MD5

    135cde4f3fdb52b79380a7e7da9f0c30

  • SHA1

    3b35b1dc8d7270d580d7b9fa66111cb210065809

  • SHA256

    a78990736434e16feb2a1ce666f36862431161f4821be9112a4608eedcca87d2

  • SHA512

    058a4d3a475f3f862ee07b4df5d3d378f834b444e98036438ea56a640b76857eb56d21008839d91f5b8b1e4f79cbb5f385b145f717725954ed58e7073c4445c7

  • SSDEEP

    49152:NRFA0Ak/INTT5bOIR23xwQ2h3uLlID22zOZEn:NRq0AkQNTZOCgwlupIDzzOZg

Malware Config

Extracted

Family

ffdroider

C2

http://186.2.171.3

Targets

    • Target

      135cde4f3fdb52b79380a7e7da9f0c30_JaffaCakes118

    • Size

      2.1MB

    • MD5

      135cde4f3fdb52b79380a7e7da9f0c30

    • SHA1

      3b35b1dc8d7270d580d7b9fa66111cb210065809

    • SHA256

      a78990736434e16feb2a1ce666f36862431161f4821be9112a4608eedcca87d2

    • SHA512

      058a4d3a475f3f862ee07b4df5d3d378f834b444e98036438ea56a640b76857eb56d21008839d91f5b8b1e4f79cbb5f385b145f717725954ed58e7073c4445c7

    • SSDEEP

      49152:NRFA0Ak/INTT5bOIR23xwQ2h3uLlID22zOZEn:NRq0AkQNTZOCgwlupIDzzOZg

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • FFDroider payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks