General

  • Target

    SkyRysen.rar

  • Size

    8.5MB

  • MD5

    e836ae0780903b10cea010398a98d74a

  • SHA1

    3c05f43f174ebd146a8243b3f309a7b7b26c7366

  • SHA256

    dcc1ce197629bbccadb87faafd61421c807bdb3da1596a1e33f8201b703c2584

  • SHA512

    c61c573fbd5ed8cdbff407585b2c57a76be193bc55b91a8f9d0295e20c299dc47741ab45beec2c3c451cdeb1a9fd6373cc0f402963c6fdf11b3cc38e35c7d015

  • SSDEEP

    196608:7cNyUkbPfZSQbAflI8hcVKsKe9COZhHTge+axEc2VvqCKA0gBMQJaEf/qJnQrc4L:ooPczOUOXHEyxYQtgBMbEXqylL

Score
10/10

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6678158569:AAGCj_95yYZbARbtI5kniGnlVkd_CTO8lfI/sendMessage?chat_id=6303202637

Signatures

  • Phemedrone family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • SkyRysen.rar
    .rar
  • SkyRysen/SkyRysen.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SkyRysen/api-ms-win-core-profile-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/api-ms-win-core-string-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/api-ms-win-core-synch-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/api-ms-win-core-util-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/api-ms-win-crt-conio-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/api-ms-win-crt-convert-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/api-ms-win-crt-environment-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/api-ms-win-crt-heap-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/api-ms-win-crt-locale-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/api-ms-win-crt-process-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/concrt140.dll
    .dll windows:6 windows x64 arch:x64

    5f9b23bd4b0029001f687a1ad625be31


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SkyRysen/dbgeng.dll
    .dll windows:6 windows x64 arch:x64

    20a4f08af0efbf58e3cff060b868e54b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SkyRysen/dbghelp.dll
    .dll windows:6 windows x64 arch:x64

    186bdce03a6f21a10c15ba86219196a5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SkyRysen/dll/api-ms-win-core-synch-l1-2-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/dll/api-ms-win-core-sysinfo-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/dll/api-ms-win-core-timezone-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/dll/api-ms-win-crt-math-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/dll/api-ms-win-crt-multibyte-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/dll/api-ms-win-crt-private-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • SkyRysen/dll/vccorlib140.dll
    .dll windows:6 windows x64 arch:x64

    d5ec94ca50152cc1e7188b825074fef2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SkyRysen/dll/vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    44c3854843f7a3fccdf8ddbbea66f302


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SkyRysen/dll/vcruntime140_1.dll
    .dll windows:6 windows x64 arch:x64

    ae0bde6314fa2027b54ce04898f6ab69


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SkyRysen/dll/vivoxsdk.dll
    .dll windows:6 windows x64 arch:x64

    d226ec7151a759ca2700b13d20e2d327


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SkyRysen/msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    2ba11fd5a511c8a409e705e9ab6b5dc1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SkyRysen/msvcp140_1.dll
    .dll windows:6 windows x64 arch:x64

    c1687527a3d5b7532fa653f66eba12e1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SkyRysen/msvcp140_2.dll
    .dll windows:6 windows x64 arch:x64

    2f8a18fefaba28c3707dae8605d51b60


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SkyRysen/msvcp140_atomic_wait.dll
    .dll windows:6 windows x64 arch:x64

    c1dfd2e42294117ca33d3c6b21826f93


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SkyRysen/msvcp140_codecvt_ids.dll
    .dll windows:6 windows x64 arch:x64

    536e29dae203b5f7347030aec0cba513


    Code Sign

    Headers

    Imports

    Exports

    Sections