General

  • Target

    5bde617d801c1b61acd96dcb09b30093d5137506ec2ee672bf5034c3c5a8f493

  • Size

    1.0MB

  • Sample

    250413-g3pzrszqt9

  • MD5

    bb031b880718e51db71c0a2a4cb437c6

  • SHA1

    1017381b4a12a9ab8cec495efb4e7d2fa7d68d91

  • SHA256

    5bde617d801c1b61acd96dcb09b30093d5137506ec2ee672bf5034c3c5a8f493

  • SHA512

    5dd34a8b1de9fa1a1afd5d5f7463ac9aa012c4cae1c84948ec6bc8741ccdc983dcacda93251a4dbe5d68696e63596db51e279854c7fed1f9e8dff983252f460d

  • SSDEEP

    24576:62eSa+JBtCN0U3qnacP1yprZDIPQc+yoV6lae95l5cIC0sqGSOtYz:D5U3qn0He95JrOtYz

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Targets

    • Target

      5bde617d801c1b61acd96dcb09b30093d5137506ec2ee672bf5034c3c5a8f493

    • Size

      1.0MB

    • MD5

      bb031b880718e51db71c0a2a4cb437c6

    • SHA1

      1017381b4a12a9ab8cec495efb4e7d2fa7d68d91

    • SHA256

      5bde617d801c1b61acd96dcb09b30093d5137506ec2ee672bf5034c3c5a8f493

    • SHA512

      5dd34a8b1de9fa1a1afd5d5f7463ac9aa012c4cae1c84948ec6bc8741ccdc983dcacda93251a4dbe5d68696e63596db51e279854c7fed1f9e8dff983252f460d

    • SSDEEP

      24576:62eSa+JBtCN0U3qnacP1yprZDIPQc+yoV6lae95l5cIC0sqGSOtYz:D5U3qn0He95JrOtYz

    • FFDroider

      Stealer targeting social media platform users first seen in April 2022.

    • Ffdroider family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks