Extracted

• • Target

    AllParse_Log/allparse_logs.exe

  • Size

    29.3MB

  • MD5

    bd3b4c0a02882e590abea24128f5891e

  • SHA1

    ccd4a73e6e4bb81d8ebd606948ed33762185b71b

  • SHA256

    c0328ab964eca37b4ee30b09c9471880ae983a9624d7f464322a11cb66790831

  • SHA512

    cae48f6ab19abe6eb20582857787d84f992e4177a13ac59eff435e9e6bfd37edbd10dbcae5e028cc0257603e667be751829ff023e4b4357f2ab68541b1aa8829

  • SSDEEP

    393216:Xf2KVJ31I9jSHDGhAriW1CPwDv3uFhtU2lvzSFrjZtFodPVa79:v2KVPI9j3WZf

  Score

  10^/10

  phemedronestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1

• • Target

    AllParse_Log/codec-library.exe

  • Size

    84KB

  • MD5

    889a77ec865cef4310258ba20e980302

  • SHA1

    554cec7ecef4d6f12ab787fa4673fc9aab24051d

  • SHA256

    eebdeac6e6bca0a720c047291a85dbb4e0c17f18af0e20b8a0c645360ae66626

  • SHA512

    1bf5b559c6091eac1b1f616f28ed2159fb32af57de6a965d659d1df235442a0bf578cb1ab3e6af95acb966f0197a5305608d3c1ba6c049a2f20f3805a8989c40

  • SSDEEP

    1536:4cZc9o6ieQnPou2PGTeR7CfoWKSO5T3rZfvSwEKSKt9jzpmO:4ci9MnPo3PHtmpS5TbZfawEKSKt9jVb

  Score

  10^/10

  phemedronespywarestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral2