Extracted

• • Target

    2385d0afe570448cb8da332cfcca8b9c9803d249f45d4c5b6b734df40c7623a2.exe

  • Size

    530KB

  • MD5

    47de26bf128ab6b0b3d18a2c49671f09

  • SHA1

    6e267c32ffafb1599282418e0b8e37eb6b57cd96

  • SHA256

    2385d0afe570448cb8da332cfcca8b9c9803d249f45d4c5b6b734df40c7623a2

  • SHA512

    58704b6e2fe7d2a1511de7f272ab61af536dd4d4dc7a7a93a2fc7a432e9cb3fb9a2d1381aec8ebeb43abb29962492aabdd0eb50b777e215b3ebee38663bc2b7f

  • SSDEEP

    12288:m1ir4NmFhWjPBXh1SXIeDVQXi+N1lMDkXADYo4CGuNvXe0aPFYR:mQvcXhQ3QLjMAQUo6ul6Py

  Score

  10^/10

  phemedronestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables packed with or use KoiVM

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2