Extracted

• • Target

    08f9ea9a663a5d463b017f8829a8ae6f875f75653433099f803c82188270eae0.exe

  • Size

    6.9MB

  • MD5

    0d7243c3e9eefa5e30c04453623c9182

  • SHA1

    f53f043451ad77189616ef823d9d27c9f089a8f7

  • SHA256

    08f9ea9a663a5d463b017f8829a8ae6f875f75653433099f803c82188270eae0

  • SHA512

    bc40fd2dfdb764161f185932b49727c8545456e1c0f2060801095fa7f4ed0d1d0eadba9e425d6ec000bc06977766d94ad637ea231642475d8531e2c94a6c442b

  • SSDEEP

    6144:nHdmxc2EKy9TVDbTi+TAJigC8tYQztwNTOcaOPgOEU20Rz:nHdSyDP4YQRwJOcFPgO1

  Score

  10^/10

  phemedronespywarestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2