General

  • Target

    2024-06-29_cb6ef36660962b9fb4f527ca90a5c535_magniber

  • Size

    4.2MB

  • Sample

    240629-eawkqstckk

  • MD5

    cb6ef36660962b9fb4f527ca90a5c535

  • SHA1

    07eedca55e697d798093020d6e156b0b736062a4

  • SHA256

    a4157f4a85da5b2660c47ac767fa4ebfcb1af6e32729456203c72fdd38873acc

  • SHA512

    c108cdb3b668eb6a7cb6d188820d743cba23e0808ef884237b4111849b52fa3c17779deaa930ac60bf66aaba51ab98b8b0acb9a81d167d94bff4c655ca27cc63

  • SSDEEP

    98304:U/JTOiDF//fWShM4/kdH0aBYLFgFvDuuIO2BFLOAkGkzdnEVomFHKnP:iC8TBQ5uuIO2BFLOyomFHKnP

Malware Config

Extracted

Family

ffdroider

C2

http://152.32.228.19

Targets

    • Target

      2024-06-29_cb6ef36660962b9fb4f527ca90a5c535_magniber

    • Size

      4.2MB

    • MD5

      cb6ef36660962b9fb4f527ca90a5c535

    • SHA1

      07eedca55e697d798093020d6e156b0b736062a4

    • SHA256

      a4157f4a85da5b2660c47ac767fa4ebfcb1af6e32729456203c72fdd38873acc

    • SHA512

      c108cdb3b668eb6a7cb6d188820d743cba23e0808ef884237b4111849b52fa3c17779deaa930ac60bf66aaba51ab98b8b0acb9a81d167d94bff4c655ca27cc63

    • SSDEEP

      98304:U/JTOiDF//fWShM4/kdH0aBYLFgFvDuuIO2BFLOAkGkzdnEVomFHKnP:iC8TBQ5uuIO2BFLOyomFHKnP

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • FFDroider payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks