Overview

overview

10

Static

static

3

a604eed132...JC.exe

windows7-x64

10

a604eed132...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a604eed1325b12671370e268783cfa74f8675a468492ff98416187d73768b4afexe_JC.exe

  • Size

    2.5MB

  • Sample

    231005-wsehlsfg78

  • MD5

    5d4392b56aa4ebac400bbe86fe5d0767

  • SHA1

    a68a6004e111ba899254aa015d93706037c447ff

  • SHA256

    a604eed1325b12671370e268783cfa74f8675a468492ff98416187d73768b4af

  • SHA512

    a2de9b684163bfad13aa23f76f32b4122ef8b9dd3a4ab557d1b395c13aafa62fd475a657cb4cc79183543a0ac2444dc457586ae17079764c27a5ffc94c8230f9

  • SSDEEP

    49152:o3s23i7y2K9TYDnORn+JuXbOoGlQXlSHcBA5TkfZnIZirM5RxivYp:

Score
10/10
phemedronespywarestealer

Malware Config

Targets

    • Target

      a604eed1325b12671370e268783cfa74f8675a468492ff98416187d73768b4afexe_JC.exe

    • Size

      2.5MB

    • MD5

      5d4392b56aa4ebac400bbe86fe5d0767

    • SHA1

      a68a6004e111ba899254aa015d93706037c447ff

    • SHA256

      a604eed1325b12671370e268783cfa74f8675a468492ff98416187d73768b4af

    • SHA512

      a2de9b684163bfad13aa23f76f32b4122ef8b9dd3a4ab557d1b395c13aafa62fd475a657cb4cc79183543a0ac2444dc457586ae17079764c27a5ffc94c8230f9

    • SSDEEP

      49152:o3s23i7y2K9TYDnORn+JuXbOoGlQXlSHcBA5TkfZnIZirM5RxivYp:

    Score
    10/10
    phemedronespywarestealer

    • Phemedrone

      An information and wallet stealer written in C#.

      stealerphemedrone

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks