General
- Target FunPev.exe
- Size 2.8MB
- Sample240204-k3s8zagcaq
- SHA256 3581ec8316ebca52d075c8c97f22857f4eaa9e5c9ba3c4c08ec0ef57f8c610b2
Score
10/10
Malware Config
Targets
-
- Target FunPev.exe
- Size 2.8MB
- SHA256 3581ec8316ebca52d075c8c97f22857f4eaa9e5c9ba3c4c08ec0ef57f8c610b2
Score10/10Phemedrone
An information and wallet stealer written in C#.
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
Creates new service(s)
Drops file in Drivers directory
Stops running service(s)
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Drops file in System32 directory
Suspicious use of SetThreadContext