Overview

overview

10

Static

static

3

tcpview.exe

windows7-x64

10

tcpview.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tcpview.exe

  • Size

    3.8MB

  • Sample

    231004-thcj6aeh65

  • MD5

    4c51b62c9ee7a37ddc010e48b516c243

  • SHA1

    77b6f4ce0867078a8d7c02fa1254912b6f4c0d00

  • SHA256

    255d887e4aee44b4a811fd99c76d7df6ce442316125d236f9b3891bd56b82f8c

  • SHA512

    8e292a6125309ad8e26606b4682001a8cfa8038818a9b28e4070a5133b73083bac608c48f00ae30e38fea170186de7e5da9c3528f8a55685c44d923c029e1adb

  • SSDEEP

    49152:T+eKofn4V0kl/gaMHqAwl6hXsM75LwV71pG7XPQx7PtwlSr+Ucbf3QC3aLVeolcB:

Score
10/10
phemedronespywarestealer

Malware Config

Targets

    • Target

      tcpview.exe

    • Size

      3.8MB

    • MD5

      4c51b62c9ee7a37ddc010e48b516c243

    • SHA1

      77b6f4ce0867078a8d7c02fa1254912b6f4c0d00

    • SHA256

      255d887e4aee44b4a811fd99c76d7df6ce442316125d236f9b3891bd56b82f8c

    • SHA512

      8e292a6125309ad8e26606b4682001a8cfa8038818a9b28e4070a5133b73083bac608c48f00ae30e38fea170186de7e5da9c3528f8a55685c44d923c029e1adb

    • SSDEEP

      49152:T+eKofn4V0kl/gaMHqAwl6hXsM75LwV71pG7XPQx7PtwlSr+Ucbf3QC3aLVeolcB:

    Score
    10/10
    phemedronestealerspyware

    • Phemedrone

      An information and wallet stealer written in C#.

      stealerphemedrone

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks