General

  • Target

    JaffaCakes118_d75160a4e7d723d77caf035aec631b1e

  • Size

    5.7MB

  • Sample

    250110-btlyvsyrej

  • MD5

    d75160a4e7d723d77caf035aec631b1e

  • SHA1

    afad2f13954beb9668752229c4f2d3ac361a8356

  • SHA256

    1e24cf9272650fc8a205eb84823f4ca69ed1b6be158cd7df2fe7389dc7dd9bdb

  • SHA512

    d5b7c576437e36496e0971ebeace37032a77e10ab2d6f1daf1b5c46001ffcdcc5a1d191fe862d4e88d98f9dfdf565d5a775a1901b911a24bc55248ab1bcfd159

  • SSDEEP

    98304:Y2b4nu+hxLKOmKpGkn+e0WUqAaYeebUvQ/qpyr0k9b+iHuNeRQhMUI+iZ7q1zPPh:Jfzd6pnG+iHuNKQbI+7NAjtVa/u

Malware Config

Extracted

Family

ffdroider

C2

http://186.2.171.3

Targets

    • Target

      JaffaCakes118_d75160a4e7d723d77caf035aec631b1e

    • Size

      5.7MB

    • MD5

      d75160a4e7d723d77caf035aec631b1e

    • SHA1

      afad2f13954beb9668752229c4f2d3ac361a8356

    • SHA256

      1e24cf9272650fc8a205eb84823f4ca69ed1b6be158cd7df2fe7389dc7dd9bdb

    • SHA512

      d5b7c576437e36496e0971ebeace37032a77e10ab2d6f1daf1b5c46001ffcdcc5a1d191fe862d4e88d98f9dfdf565d5a775a1901b911a24bc55248ab1bcfd159

    • SSDEEP

      98304:Y2b4nu+hxLKOmKpGkn+e0WUqAaYeebUvQ/qpyr0k9b+iHuNeRQhMUI+iZ7q1zPPh:Jfzd6pnG+iHuNKQbI+7NAjtVa/u

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • FFDroider payload

    • Ffdroider family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks