Behavioral task
behavioral1
Sample
Phemedrone.Tools.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Phemedrone.Tools.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
dnlib.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
dnlib.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
stub/stub.exe
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
stub/stub.exe
Resource
win10v2004-20230915-en
General
-
Target
sys.zip
-
Size
457KB
-
MD5
ac732232b665f61d349319e37460abb8
-
SHA1
3291c9ca3aba04379391e8c5cb7c57264d1a8c08
-
SHA256
fbb17fcbb78a3c7d6ab25984cce87958fcd70a8f09a5c013120f4a4bb620744c
-
SHA512
7e444f990dcff902f959f870c504c43fba3e015711ab309aa8e8a5befd76d5a6e5c296a7af3a7d9890f1f0cebc053f9c40533d461ed0498b7e31fe30a4be14d4
-
SSDEEP
12288:IAGJgaKHBtITuOerur+BsIsC4fl1+o0Uf4J8vqXklbHyWnLj:e7ytISOZrmFr49vKklbSWLj
Malware Config
Signatures
-
Phemedrone family
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Phemedrone.Tools.exe unpack001/dnlib.dll unpack001/stub/stub
Files
-
sys.zip.zip
-
Phemedrone.Tools.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
dnlib.dll.dll windows:4 windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
stub/stub.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
⥪⮢ 㬥.txt