Overview

overview

10

Static

static

10

457461a6ad...6c.exe

windows7-x64

10

457461a6ad...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    457461a6ad3b12a397d8ab96da9355dcb9954576c6552f3f8dc2d7e80ac17a6c.exe

  • Size

    97KB

  • Sample

    240423-bn16laag8z

  • MD5

    ee6038d5c37842bc34a6e17fd8478339

  • SHA1

    2259364fc16b0c344e35b8afc0182e79857917b6

  • SHA256

    457461a6ad3b12a397d8ab96da9355dcb9954576c6552f3f8dc2d7e80ac17a6c

  • SHA512

    e833440b4f3533020bf498511fb5d78b3d9cf21fb04d020a696b3714920869fb62b2f73272e99f224e317ff03f214581ba4bb2b53925d3d8225d672b3e493e67

  • SSDEEP

    1536:n+G1e0GWGl4tS6Bh1pI//W/9/fnFP5psgnCyQqJSwEKMiV7LU:n+Gs0il4jI/uF3nt5OgnCyQrwEKlhA

Score
10/10
phemedronespywarestealer

Malware Config

Extracted

Family

phemedrone

C2

http://77.221.151.42/dashboard/gate.php

Targets

    • Target

      457461a6ad3b12a397d8ab96da9355dcb9954576c6552f3f8dc2d7e80ac17a6c.exe

    • Size

      97KB

    • MD5

      ee6038d5c37842bc34a6e17fd8478339

    • SHA1

      2259364fc16b0c344e35b8afc0182e79857917b6

    • SHA256

      457461a6ad3b12a397d8ab96da9355dcb9954576c6552f3f8dc2d7e80ac17a6c

    • SHA512

      e833440b4f3533020bf498511fb5d78b3d9cf21fb04d020a696b3714920869fb62b2f73272e99f224e317ff03f214581ba4bb2b53925d3d8225d672b3e493e67

    • SSDEEP

      1536:n+G1e0GWGl4tS6Bh1pI//W/9/fnFP5psgnCyQqJSwEKMiV7LU:n+Gs0il4jI/uF3nt5OgnCyQrwEKlhA

    Score
    10/10
    phemedronespywarestealer

    • Phemedrone

      An information and wallet stealer written in C#.

      stealerphemedrone

    • Detect binaries embedding considerable number of MFA browser extension IDs.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks