General

  • Target

    Korepi.rar

  • Size

    8.3MB

  • MD5

    43c7f5c4214172e5aa95184912871658

  • SHA1

    7df1b4192a6da11a6580db130b0e544f03705288

  • SHA256

    1fda8701361410f4d24d8b4886d114424f07c18bfee78adf64170b87800baa87

  • SHA512

    ae2cf967e289010a29d794fba6d0d9c11398def6319bcedd4145256cdd68c036f4eca347321d3fb20842146ea0c53c3b5c8903bba586f8268564e694ff59b6e5

  • SSDEEP

    196608:6cNyUkbWfZSQfTLlI8hcVKsKe9COZhHTge+axEc2VvqCKA0gBMQJaEf/qJnQrc5K:joWcqOUOXHEyxYQtgBMbEXqOoK

Score
10/10

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6678158569:AAGCj_95yYZbARbtI5kniGnlVkd_CTO8lfI/sendMessage?chat_id=6303202637

Signatures

  • Phemedrone family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Korepi.rar
    .rar
  • Korepi/Korepi.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Korepi/concrt140.dll
    .dll windows:6 windows x64 arch:x64

    5f9b23bd4b0029001f687a1ad625be31


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Korepi/dbgeng.dll
    .dll windows:6 windows x64 arch:x64

    20a4f08af0efbf58e3cff060b868e54b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Korepi/dbghelp.dll
    .dll windows:6 windows x64 arch:x64

    186bdce03a6f21a10c15ba86219196a5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Korepi/dll/vccorlib140.dll
    .dll windows:6 windows x64 arch:x64

    d5ec94ca50152cc1e7188b825074fef2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Korepi/dll/vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    44c3854843f7a3fccdf8ddbbea66f302


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Korepi/dll/vcruntime140_1.dll
    .dll windows:6 windows x64 arch:x64

    ae0bde6314fa2027b54ce04898f6ab69


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Korepi/dll/vivoxsdk.dll
    .dll windows:6 windows x64 arch:x64

    d226ec7151a759ca2700b13d20e2d327


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Korepi/msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    2ba11fd5a511c8a409e705e9ab6b5dc1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Korepi/msvcp140_1.dll
    .dll windows:6 windows x64 arch:x64

    c1687527a3d5b7532fa653f66eba12e1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Korepi/msvcp140_2.dll
    .dll windows:6 windows x64 arch:x64

    2f8a18fefaba28c3707dae8605d51b60


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Korepi/msvcp140_atomic_wait.dll
    .dll windows:6 windows x64 arch:x64

    c1dfd2e42294117ca33d3c6b21826f93


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Korepi/msvcp140_codecvt_ids.dll
    .dll windows:6 windows x64 arch:x64

    536e29dae203b5f7347030aec0cba513


    Code Sign

    Headers

    Imports

    Exports

    Sections