phemedrone | ee6038d5c37842bc34a6e17fd8478339[.]exe | Triage

Sharing

General

Target

ee6038d5c37842bc34a6e17fd8478339.exe
Size

97KB
MD5

ee6038d5c37842bc34a6e17fd8478339
SHA1

2259364fc16b0c344e35b8afc0182e79857917b6
SHA256

457461a6ad3b12a397d8ab96da9355dcb9954576c6552f3f8dc2d7e80ac17a6c
SHA512

e833440b4f3533020bf498511fb5d78b3d9cf21fb04d020a696b3714920869fb62b2f73272e99f224e317ff03f214581ba4bb2b53925d3d8225d672b3e493e67
SSDEEP

1536:n+G1e0GWGl4tS6Bh1pI//W/9/fnFP5psgnCyQqJSwEKMiV7LU:n+Gs0il4jI/uF3nt5OgnCyQrwEKlhA

Score

10^/10

phemedrone

Malware Config

Extracted

Family

phemedrone

C2

http://77.221.151.42/dashboard/gate.php

Signatures

Phemedrone family
phemedrone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
ee6038d5c37842bc34a6e17fd8478339.exe

Files

ee6038d5c37842bc34a6e17fd8478339.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\munish\Downloads\Phemedrone-Stealer-main\Phemedrone-Stealer-main\Phemedrone-Stealer\obj\Release\Accounts_Ledger.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ