General

  • Target

    097ee22514e22938f10c32a70ffe6aea00d8a85fb71e595dc34aa2699ab2c5a0

  • Size

    83KB

  • Sample

    240107-yslb9sebf3

  • MD5

    d442757de4cff41fed5e04314a9f57de

  • SHA1

    f7d3b05e97bbc5e3fffb3d59c102b75ad9f4ca1a

  • SHA256

    097ee22514e22938f10c32a70ffe6aea00d8a85fb71e595dc34aa2699ab2c5a0

  • SHA512

    4c8f2a6356e02c55db7c9ac2573fd113f1cef635bbf119213a2955f5c4c57e3a71fee20cdb52164154a50c12a38b834bad29ff87a73ebe99b03e5dccaf2e7df3

  • SSDEEP

    1536:9YZJfg42yXGKnGTX4Yd/exySO5T3rZSSwEKSKh9TzpmR:9YZJfg42y3naldmxa5TbZLwEKSKh9TVM

Malware Config

Extracted

Family

phemedrone

C2

127.0.0.1:1337

Targets

    • Target

      097ee22514e22938f10c32a70ffe6aea00d8a85fb71e595dc34aa2699ab2c5a0

    • Size

      83KB

    • MD5

      d442757de4cff41fed5e04314a9f57de

    • SHA1

      f7d3b05e97bbc5e3fffb3d59c102b75ad9f4ca1a

    • SHA256

      097ee22514e22938f10c32a70ffe6aea00d8a85fb71e595dc34aa2699ab2c5a0

    • SHA512

      4c8f2a6356e02c55db7c9ac2573fd113f1cef635bbf119213a2955f5c4c57e3a71fee20cdb52164154a50c12a38b834bad29ff87a73ebe99b03e5dccaf2e7df3

    • SSDEEP

      1536:9YZJfg42yXGKnGTX4Yd/exySO5T3rZSSwEKSKh9TzpmR:9YZJfg42y3naldmxa5TbZLwEKSKh9TVM

    • Phemedrone

      An information and wallet stealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks