Resubmissions

01-05-2024 11:36

240501-nq1dasga74 10

01-05-2024 11:33

240501-nnwmbsga28 10

General

  • Target

    Blaster.rar

  • Size

    65.1MB

  • Sample

    240501-nnwmbsga28

  • MD5

    df9039f8873c36812398f7f7bcd9edca

  • SHA1

    cb08ca1fbf02c524ed9b425ecc0ff40d327067e6

  • SHA256

    effd48689ee7728a354cd1520d6193a75eae8dc8b39c954dc3ca132241eb0906

  • SHA512

    f57d4ea8367ef28249c8209f931760f98116e4d57c3beaea71c7f5101fdbc448606cf7a23f101942de583aefeff4dc0ca5b33fd95514ba10f0dc288e6aab8c55

  • SSDEEP

    1572864:wLpnCLVxoqtFOjJbt8vuTO885ctzkqXt6BuqDh9Rm7VKMJ2M:wLgPoqHF88+tz+uqNb652M

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7198738266:AAHTvaHo7OnTgbVRXdKU7z4g6AfvN3nTrb8/sendDocument

Targets

    • Target

      Blaster.rar

    • Size

      65.1MB

    • MD5

      df9039f8873c36812398f7f7bcd9edca

    • SHA1

      cb08ca1fbf02c524ed9b425ecc0ff40d327067e6

    • SHA256

      effd48689ee7728a354cd1520d6193a75eae8dc8b39c954dc3ca132241eb0906

    • SHA512

      f57d4ea8367ef28249c8209f931760f98116e4d57c3beaea71c7f5101fdbc448606cf7a23f101942de583aefeff4dc0ca5b33fd95514ba10f0dc288e6aab8c55

    • SSDEEP

      1572864:wLpnCLVxoqtFOjJbt8vuTO885ctzkqXt6BuqDh9Rm7VKMJ2M:wLgPoqHF88+tz+uqNb652M

    • Phemedrone

      An information and wallet stealer written in C#.

    • Executes dropped EXE

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks