sys.zip
- SHA256 fbb17fcbb78a3c7d6ab25984cce87958fcd70a8f09a5c013120f4a4bb620744c
Behavioral task
behavioral1
Sample
sys.zip
Resource
win10v2004-20230915-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Phemedrone.Tools.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral3
Sample
⥪⮢ 㬥.txt
Resource
win10v2004-20230915-en
windows10-2004-x64
1 signatures
1800 seconds
General
- Target sys.zip
- Size 457KB
- Sample230924-nscd9aff34
- SHA256 fbb17fcbb78a3c7d6ab25984cce87958fcd70a8f09a5c013120f4a4bb620744c
- MD5 ac732232b665f61d349319e37460abb8
- SHA1 3291c9ca3aba04379391e8c5cb7c57264d1a8c08
- SHA512 7e444f990dcff902f959f870c504c43fba3e015711ab309aa8e8a5befd76d5a6e5c296a7af3a7d9890f1f0cebc053f9c40533d461ed0498b7e31fe30a4be14d4
- SSDEEP 12288:IAGJgaKHBtITuOerur+BsIsC4fl1+o0Uf4J8vqXklbHyWnLj:e7ytISOZrmFr49vKklbSWLj
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Phemedrone family
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Phemedrone.Tools.exe unpack001/dnlib.dll unpack001/stub/stub
File Explorer
-
sys.zip.zip 457KB
-
Phemedrone.Tools.exe.exe 46KB
-
dnlib.dll.dll 1.1MB
-
stub/stub.exe 83KB
-
⥪⮢ 㬥.txt58B
Phemedrone.Tools.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 39ecce4c3f736299577c508670fe23c528b2e9aa076bbfbd3f0fc49ef0e6fb55
- MD5 a6bf693fe68cd3d8c1e6f15463734193
- SHA1 84ab3ff2163239fa6701206da4ae8e903060be21
- SHA512 2cb88ca582248ead8f6c839ea377b459453fe559bd2b8ab8cc38043025b8554692f4a6743a92bd67e0301d203c89faac0b28f6d5370a594f7bd4a552cf9f52ea
- SSDEEP 768:aqUy9SrcY7P2/P0nmNQBvyOUFVvyjj7Mr6r48lG8G5eYcM+2:LUyacKPZlBvyOEVcjmh75pca
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 648950f725fb0320e09c52dcaf81764916df96dc62e7429ba67daea0acb784ea
- MD5 5cc2bb48b5e8c8ac0b99669401d15456
- SHA1 02e9ae08f3ec364834eb3ffc122f1c90e1b0e95e
- SHA512 2867e94cee9f89f1cf85ad01083d75f4bc0bc0e551b2ffae05581828994f2b01a458ac7a7c94a45e8c40858ecce197f7ec23482ee13ef3f1bf82b33b89b3b420
- SSDEEP 24576:/bN7xZgKVl/N12pljD7DM2l8xs5A/zYv7flNcK:DyJXn3ML7G
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1172690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
stub/stub
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fdf3d67df1d0dd6bf150308cf1cc39c7f11cd808e45ecb31df9cc1c288670f15
- MD5 e9f08b24f1edc1b14d47b7abaef8a03b
- SHA1 e11c3be9bc129931ea7f77ec086035f1a0dd5e9a
- SHA512 763ab12868173584d7bb0e42cd1b6a8f7048f13c5d27ac2ac1df3e058407e5859127c18f7075895c736565da3ca0bd2065f99148091041bc58c519b2bc0965be
- SSDEEP 1536:WdE4PhxQwIJeUzTduCWUQVuQYkEFY5NSkfDhz/BXmpeTxonCr5T3PZTSwEKYKIO8:KkeUHd1Wx1NSkfDhz/BbOc5TfZuwEKYd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
90494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
⥪⮢ 㬥.txt
- SHA256 3b1cd24f46f68e3a5982bdb8c1391988ac747a6cf66b8af32098882e8ede20eb
- MD5 a0f07f3ac987737b471b85ced9e676c3
- SHA1 1675ceb4e042bb42c64da74bf5eda0e873112012
- SHA512 801b432f2b43ce4148267df35c0c50c886342a830357330902ad046742e0c4b5ed38c597bf2bcdaf145ac937ec26a026f7a89cf0fe8aa4e4c910c46300d65385
- MD5 SHA1 SHA512