General

  • Target

    9737f768f5539cb2a0853f265e4c32a1_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240814-xaa8xasdql

  • MD5

    9737f768f5539cb2a0853f265e4c32a1

  • SHA1

    e91bac502e203094878457a58a70aa0261bc6322

  • SHA256

    3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa

  • SHA512

    6fbcd5ab193fd7a9193238b031e1efef8efae52d6d24f011bd0420baffe6b330c126f5315bc6d20ff50186ec175910db93ef9c41a187e20aa1d4b36b55e6df22

  • SSDEEP

    24576:hbIQ9iBHtWkOLTBDNSl6nNoYOmubsdI5oansjqFJaN0cKKwt:Z9ibiTBDNXTJjqFDc9w

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Targets

    • Target

      9737f768f5539cb2a0853f265e4c32a1_JaffaCakes118

    • Size

      1.1MB

    • MD5

      9737f768f5539cb2a0853f265e4c32a1

    • SHA1

      e91bac502e203094878457a58a70aa0261bc6322

    • SHA256

      3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa

    • SHA512

      6fbcd5ab193fd7a9193238b031e1efef8efae52d6d24f011bd0420baffe6b330c126f5315bc6d20ff50186ec175910db93ef9c41a187e20aa1d4b36b55e6df22

    • SSDEEP

      24576:hbIQ9iBHtWkOLTBDNSl6nNoYOmubsdI5oansjqFJaN0cKKwt:Z9ibiTBDNXTJjqFDc9w

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks