Extracted

• • Target

    f9bba25adc0c0506f5833a4ccb3c429e3e460bf194dbc5ab14c78054d7640f9e.exe

  • Size

    4.9MB

  • MD5

    7f49f7a154d31e309f1ca0e83e8c6315

  • SHA1

    9b91a45407fcfd6bf645baab7dd5b38e8f999c12

  • SHA256

    f9bba25adc0c0506f5833a4ccb3c429e3e460bf194dbc5ab14c78054d7640f9e

  • SHA512

    3a11bfe10c4462dc5144f1627c7f6ee42671c0264c70b327bf6b8418f7cd95a9a41095ec787b9ab0b7dfc7460652836479e531ec0c1c66c17a6e0cf29f176852

  • SSDEEP

    12288:Ufbh2x/HsPrx2766qvB0azE5eDBIDLLPuIn:iTXvduDz

  Score

  10^/10

  phemedronespywarestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2