Overview

overview

10

Static

static

3

7966834c1d...09.exe

windows7-x64

7

7966834c1d...09.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7966834c1d2820f4662d2cf896f92b9e219d48f9a96963b5b3efa8be1a72c809

  • Size

    5.3MB

  • Sample

    240414-3e57qsbc8t

  • MD5

    fedee37af6c431a3207fe8d25c882a4e

  • SHA1

    ea7be9251e52d05120599033d73dd959d81c2310

  • SHA256

    7966834c1d2820f4662d2cf896f92b9e219d48f9a96963b5b3efa8be1a72c809

  • SHA512

    1d16785f913752b4621a71889f57059e8b9ac7eabc901effbb3baac3676cc3474ee4a9993d0a193beef745780175f9b1c04e159ef8febe23c25c417fef978e53

  • SSDEEP

    98304:+J1ezhQcSZcOb+sX1Zvbez14Z0FGRABTgtse6vzovkNu:+8hQcERCsXDjYZkJMU

Score
10/10
phemedronepyinstallerspywarestealer

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6699343870:AAGOms3s--pO8LwD1p3vPosnjG5pMMzXG9w/sendDocument

Targets

    • Target

      7966834c1d2820f4662d2cf896f92b9e219d48f9a96963b5b3efa8be1a72c809

    • Size

      5.3MB

    • MD5

      fedee37af6c431a3207fe8d25c882a4e

    • SHA1

      ea7be9251e52d05120599033d73dd959d81c2310

    • SHA256

      7966834c1d2820f4662d2cf896f92b9e219d48f9a96963b5b3efa8be1a72c809

    • SHA512

      1d16785f913752b4621a71889f57059e8b9ac7eabc901effbb3baac3676cc3474ee4a9993d0a193beef745780175f9b1c04e159ef8febe23c25c417fef978e53

    • SSDEEP

      98304:+J1ezhQcSZcOb+sX1Zvbez14Z0FGRABTgtse6vzovkNu:+8hQcERCsXDjYZkJMU

    Score
    10/10
    phemedronespywarestealer

    • Phemedrone

      An information and wallet stealer written in C#.

      stealerphemedrone

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks