Overview

overview

10

Static

static

3

2385d0afe5...a2.exe

windows7-x64

10

2385d0afe5...a2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2385d0afe570448cb8da332cfcca8b9c9803d249f45d4c5b6b734df40c7623a2.exe

  • Size

    530KB

  • Sample

    240323-ckct9scb29

  • MD5

    47de26bf128ab6b0b3d18a2c49671f09

  • SHA1

    6e267c32ffafb1599282418e0b8e37eb6b57cd96

  • SHA256

    2385d0afe570448cb8da332cfcca8b9c9803d249f45d4c5b6b734df40c7623a2

  • SHA512

    58704b6e2fe7d2a1511de7f272ab61af536dd4d4dc7a7a93a2fc7a432e9cb3fb9a2d1381aec8ebeb43abb29962492aabdd0eb50b777e215b3ebee38663bc2b7f

  • SSDEEP

    12288:m1ir4NmFhWjPBXh1SXIeDVQXi+N1lMDkXADYo4CGuNvXe0aPFYR:mQvcXhQ3QLjMAQUo6ul6Py

Score
10/10
phemedronestealer

Malware Config

Extracted

Family

phemedrone

C2

10.5.0.2

Targets

    • Target

      2385d0afe570448cb8da332cfcca8b9c9803d249f45d4c5b6b734df40c7623a2.exe

    • Size

      530KB

    • MD5

      47de26bf128ab6b0b3d18a2c49671f09

    • SHA1

      6e267c32ffafb1599282418e0b8e37eb6b57cd96

    • SHA256

      2385d0afe570448cb8da332cfcca8b9c9803d249f45d4c5b6b734df40c7623a2

    • SHA512

      58704b6e2fe7d2a1511de7f272ab61af536dd4d4dc7a7a93a2fc7a432e9cb3fb9a2d1381aec8ebeb43abb29962492aabdd0eb50b777e215b3ebee38663bc2b7f

    • SSDEEP

      12288:m1ir4NmFhWjPBXh1SXIeDVQXi+N1lMDkXADYo4CGuNvXe0aPFYR:mQvcXhQ3QLjMAQUo6ul6Py

    Score
    10/10
    phemedronestealer

    • Phemedrone

      An information and wallet stealer written in C#.

      stealerphemedrone

    • Detect binaries embedding considerable number of MFA browser extension IDs.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects executables packed with or use KoiVM

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks