General

  • Target

    770986a9dc4ba53e1614bd2c332d3fef_JaffaCakes118

  • Size

    2.0MB

  • Sample

    240727-ez1wrazflg

  • MD5

    770986a9dc4ba53e1614bd2c332d3fef

  • SHA1

    b45eeb63a90a3c6746a85fbd08b10f0da2ffe5ab

  • SHA256

    d335aac3dfba859d42e1280289dde0f4bca2d13d49077220e84afba588df0680

  • SHA512

    7d91f021a6afac01951f654e0a214e585a9d4e8eb139c205b2d592ca6e2761f1b4d62104ea38010526f820bff8ae0fcb2d3d7116ad996e512029ce69bfbcfba5

  • SSDEEP

    49152:Xws0SgcddjsF/Iz8NE9cymBlyet9X4MFPrtMizu1za:XAJs5Lz8NZyEyk4qPhMvQ

Malware Config

Extracted

Family

ffdroider

C2

http://186.2.171.3

Targets

    • Target

      770986a9dc4ba53e1614bd2c332d3fef_JaffaCakes118

    • Size

      2.0MB

    • MD5

      770986a9dc4ba53e1614bd2c332d3fef

    • SHA1

      b45eeb63a90a3c6746a85fbd08b10f0da2ffe5ab

    • SHA256

      d335aac3dfba859d42e1280289dde0f4bca2d13d49077220e84afba588df0680

    • SHA512

      7d91f021a6afac01951f654e0a214e585a9d4e8eb139c205b2d592ca6e2761f1b4d62104ea38010526f820bff8ae0fcb2d3d7116ad996e512029ce69bfbcfba5

    • SSDEEP

      49152:Xws0SgcddjsF/Iz8NE9cymBlyet9X4MFPrtMizu1za:XAJs5Lz8NZyEyk4qPhMvQ

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • FFDroider payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks