HackTool.MSIL.GrabFF.A

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Hacking Tool adds the following folders:

• {2nd argument} → contains folders of successful infiltration on the list of targets
• {2nd argument}\__{Computer Name or IP Address}_{Drive Letter}$_users_{user name} → contains stolen information

Information Theft

This Hacking Tool gathers the following data:

• Information from Mozilla Firefox:
  • Encryption key used for encrypting and decrypting the passwords → key3.db and key4.db
  • Encrypted usernames and passwords → logins.json
  • Certificate authorities → cert9.db

Other Details

This Hacking Tool does the following:

• Checks all the available users from the list of targeted machines in {1st argument} if "{user name}\AppData\Roaming\Mozilla\Firefox\Profiles" is present.
  • If the said directory is accessible, searches the following files and copies them into the {2nd argument}\__{Computer Name or IP Address}_{Drive Letter}$_users_{user name}:
    • key4.db
    • key3.db
    • logins.json
    • cert9.db

It accepts the following parameters:

• {1st Argument} → {File containing a list of Computer Name and/or IP Addresses seperated by a new line}
• {2nd Argument} → {Path to store stolen information}
• {3rd Argument} → {Number of threads to create/run simultaneously}