Behavioral task
behavioral1
Sample
Jefutyl.zip
Resource
win10v2004-20230915-en
General
-
Target
Jefutyl.zip
-
Size
38KB
-
MD5
46ad12d7699b3f9a0ce5f70b08324677
-
SHA1
4b3950b2a378661310472427acaf26272373ed21
-
SHA256
3fb1c3589b3a7636337ae5284974f79f99e4c015977a4fa1eeeeb42d79590181
-
SHA512
d455cd28d8365380494f2ed8f59cf99fcd17dba3b94efe558d307b95abf7e232e5b17ad47f1fb068d4e3bec7214fa88e71fbb8203d1728cfe0371c5013d8d5ef
-
SSDEEP
768:Q6cNV9G4WCsEimmJFLzW/6/RDFC+cPn22xHoMvBhw1gFakQdloivG/ERKjT:ZC1WlFw6/pPUxTw1cakQd6ivbRKjT
Malware Config
Extracted
phemedrone
https://api.telegram.org/bot6421901210:AAErC913wmPS9T_-XJrvOWFdTxw2TkS248A/sendMessage?chat_id=5896425070
Signatures
-
Phemedrone family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/Jefutyl.exe
Files
-
Jefutyl.zip.zip
-
Jefutyl.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ