Extracted

• • Target

    400471a357266923af7b64048acd77f3d132dd429c3ef8eae4ab5dfd6652fd39.exe

  • Size

    313KB

  • MD5

    accf109edfa6ea05bb88505668ad8e28

  • SHA1

    d3cb874e0db864d16b90a5a6ecac2651b2fc5c41

  • SHA256

    400471a357266923af7b64048acd77f3d132dd429c3ef8eae4ab5dfd6652fd39

  • SHA512

    7a63951e9baba219769e1186c126dfe2fee5d8fc9e46000add310fb1e432118017b43cebff926e095da3a67b134307260024f02d9d055856268db407568287e7

  • SSDEEP

    6144:kfdmxcbEKy9TVUfUnBfrmjlyRVLkJqJVpHO5CZ7Rm:kfdShVBfrmjsN/pf7Rm

  Score

  10^/10

  phemedronespywarestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2