Overview

overview

10

Static

static

10

Bodymud.exe

windows7-x64

10

Bodymud.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bodymud.exe

  • Size

    313KB

  • Sample

    240307-pllj1sah94

  • MD5

    accf109edfa6ea05bb88505668ad8e28

  • SHA1

    d3cb874e0db864d16b90a5a6ecac2651b2fc5c41

  • SHA256

    400471a357266923af7b64048acd77f3d132dd429c3ef8eae4ab5dfd6652fd39

  • SHA512

    7a63951e9baba219769e1186c126dfe2fee5d8fc9e46000add310fb1e432118017b43cebff926e095da3a67b134307260024f02d9d055856268db407568287e7

  • SSDEEP

    6144:kfdmxcbEKy9TVUfUnBfrmjlyRVLkJqJVpHO5CZ7Rm:kfdShVBfrmjsN/pf7Rm

Score
10/10
phemedronespywarestealer

Malware Config

Extracted

Family

phemedrone

C2

https://rakishevkenes.com/wp-admin/admin-ajax.php

Targets

    • Target

      Bodymud.exe

    • Size

      313KB

    • MD5

      accf109edfa6ea05bb88505668ad8e28

    • SHA1

      d3cb874e0db864d16b90a5a6ecac2651b2fc5c41

    • SHA256

      400471a357266923af7b64048acd77f3d132dd429c3ef8eae4ab5dfd6652fd39

    • SHA512

      7a63951e9baba219769e1186c126dfe2fee5d8fc9e46000add310fb1e432118017b43cebff926e095da3a67b134307260024f02d9d055856268db407568287e7

    • SSDEEP

      6144:kfdmxcbEKy9TVUfUnBfrmjlyRVLkJqJVpHO5CZ7Rm:kfdShVBfrmjsN/pf7Rm

    Score
    10/10
    phemedronespywarestealer

    • Phemedrone

      An information and wallet stealer written in C#.

      stealerphemedrone

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks