General

  • Target
    SkyRysen.rar
  • Size 8.5MB
  • Sample240218-vbdpbach46
  • SHA256 dcc1ce197629bbccadb87faafd61421c807bdb3da1596a1e33f8201b703c2584
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • phemedrone

C2
  • https://api.telegram.org/bot6678158569:AAGCj_95yYZbARbtI5kniGnlVkd_CTO8lfI/sendMessage?chat_id=6303202637

Targets

    • Target
      SkyRysen/SkyRysen.exe
    • Size 84KB
    • SHA256 d8604a6641d5743df9a0324f179476afe197cb63e2b94cbbce78aee2a348b5e1
    • MD5 SHA1 SHA512 SSDEEP
    • Phemedrone

      An information and wallet stealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Target
      SkyRysen/api-ms-win-core-profile-l1-1-0.dll
    • Size 11KB
    • SHA256 db622e345d6481a2fd8692ab667173870c3da16c1ec2883e0f2f94dfc75d23b9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/api-ms-win-core-rtlsupport-l1-1-0.dll
    • Size 12KB
    • SHA256 dc66d579f32f37a30caa7ceaa97d882100fd782898bfc9e6cd8de5f3fe121a8a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/api-ms-win-core-string-l1-1-0.dll
    • Size 11KB
    • SHA256 52696a6a470462edffd37f2f848c0601b44afc0b1c353799fae6ddd4ee4336e6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/api-ms-win-core-synch-l1-1-0.dll
    • Size 13KB
    • SHA256 4bbe96fd5b5d3a4f5c7e93262fbd0e6c638e719c00d6b316b1e5149f9154d8c1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/api-ms-win-core-util-l1-1-0.dll
    • Size 11KB
    • SHA256 612c71cd87bf296a4918da65a6be9adaac87d21a1f1c8c31860a3baba69d2d44
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/api-ms-win-crt-conio-l1-1-0.dll
    • Size 12KB
    • SHA256 0b52cab46e0a2c87cc3c114518aeeea8a0b774b748247d0ea45be2deb496711c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/api-ms-win-crt-convert-l1-1-0.dll
    • Size 15KB
    • SHA256 dc2205d27942d0494dff0cdd6fa2776e2a948a7f8d09f34955bfa1f479c9c2ce
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/api-ms-win-crt-environment-l1-1-0.dll
    • Size 12KB
    • SHA256 2219d56c71e96692ae8573f802eb190428e296bacd1613959d199a41a9d9acaf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/api-ms-win-crt-filesystem-l1-1-0.dll
    • Size 13KB
    • SHA256 0074669eeb5234606ef73dc118f580fe438eeba6ca7279e9b3d64a26c0b100ec
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/api-ms-win-crt-heap-l1-1-0.dll
    • Size 12KB
    • SHA256 22b0ba155409f5b3936e53887795179e741bac475c4d3cbe61eb923fec587fba
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/api-ms-win-crt-locale-l1-1-0.dll
    • Size 12KB
    • SHA256 876c9715dcd825995def190457ca9d2f0fe38775bb01a2dcb4e62b187c5ee428
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/api-ms-win-crt-process-l1-1-0.dll
    • Size 12KB
    • SHA256 1c208b78198e501205f89768bc100ea9605e2f616f0cd7db2fd56760a864a7d6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/concrt140.dll
    • Size 310KB
    • SHA256 573229a07f38ab9d2fc2e1a5b98e9243b9b39100323180c83ad7ddaf98eee46a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dbgeng.dll
    • Size 4.1MB
    • SHA256 38c6aa8b85f388b814e2239a6a7355a999130a3cf1893a3219371f694d9759d3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dbghelp.dll
    • Size 1.3MB
    • SHA256 159b30d9f1bbe69ae03e0d19669d4fcb565246d81672b7034a69cef9f466dcbe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dll/api-ms-win-core-synch-l1-2-0.dll
    • Size 12KB
    • SHA256 5e696fbe467b10158abcfcfea82995a9ead018a5870581539183c78830dc5168
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dll/api-ms-win-core-sysinfo-l1-1-0.dll
    • Size 12KB
    • SHA256 46ed253e8ccb8e488045d349a6986fd4e2715d1962c2fe998eec003d576f0102
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dll/api-ms-win-core-timezone-l1-1-0.dll
    • Size 12KB
    • SHA256 752fd5e2618f98678de97af8b461c9249f67c69a4fcc7ca3373f17487bafbbb8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dll/api-ms-win-crt-math-l1-1-0.dll
    • Size 20KB
    • SHA256 32860e3e8b279bb83dacbb827482c7d7e4e1b8d6e56ad1c94f451ce83138792f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dll/api-ms-win-crt-multibyte-l1-1-0.dll
    • Size 19KB
    • SHA256 445e5fc4a39b5758e1e6d268865f53f4b331374300bf52aac20766acc60deca8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dll/api-ms-win-crt-private-l1-1-0.dll
    • Size 63KB
    • SHA256 ddc0289a8a719374074f6484969c223491e469dcf7e2cbb7ac29dd0c4b7e5a8c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dll/vccorlib140.dll
    • Size 327KB
    • SHA256 79284659bf4302162302737d2513b17e09742cdefb9540e80f97d30c93077d7c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dll/vcruntime140.dll
    • Size 95KB
    • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dll/vcruntime140_1.dll
    • Size 36KB
    • SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/dll/vivoxsdk.dll
    • Size 11.9MB
    • SHA256 1d932531cca6411e1eb93b455481a486e8f2041b54312838d0d21957e04e8583
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/msvcp140.dll
    • Size 553KB
    • SHA256 9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/msvcp140_1.dll
    • Size 23KB
    • SHA256 8731a93e519c2595c9fd489e6d9ac07e964448c0da1c8ee9ee500a7989482617
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/msvcp140_2.dll
    • Size 182KB
    • SHA256 366af8e071f004da5d95a832a46b2e8821a8e0294340a93f7c95cf48c441067e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/msvcp140_atomic_wait.dll
    • Size 55KB
    • SHA256 c61a28711f8c6e9bfd4879cf5f53b013d653badad308abe3e887c694b223d6f0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      SkyRysen/msvcp140_codecvt_ids.dll
    • Size 20KB
    • SHA256 9b45fd069bd0076d8abfeb7c3c30a1f5c5fc8e7124017853a93d831a346c3d21
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks