General

  • Target

    Loader.exe

  • Size

    116KB

  • Sample

    240604-bmqcpsgg89

  • MD5

    6b9624df4bd06c99d7efc30553af70c3

  • SHA1

    61e0276f3937b1821dd4f760f4019d894be3d71c

  • SHA256

    1912bab5a7418443b8685aa3917cd2a8c2ad29d07b6a7c2cc658ecc6ee953160

  • SHA512

    bf902f0b8b0697c0e214079c5c2775d1514a033c178ec6c8bf40942dc9b1ee76e5d8f084c37aa01aaeec962b22bb4fb23d89910afc179323b4742bd4d9e18f2b

  • SSDEEP

    1536:Td2vVBczxcYZv3RodgTONZm99V7K6arNsA5M0X8zhQNkSpPEGMdSGkM:B2X8b+qmZmbV7PaWA5H1Tc

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7250665686:AAHW0YznZP8w-6An0q8-OF3zVVfXyjQuxLM/sendDocument

Targets

    • Target

      Loader.exe

    • Size

      116KB

    • MD5

      6b9624df4bd06c99d7efc30553af70c3

    • SHA1

      61e0276f3937b1821dd4f760f4019d894be3d71c

    • SHA256

      1912bab5a7418443b8685aa3917cd2a8c2ad29d07b6a7c2cc658ecc6ee953160

    • SHA512

      bf902f0b8b0697c0e214079c5c2775d1514a033c178ec6c8bf40942dc9b1ee76e5d8f084c37aa01aaeec962b22bb4fb23d89910afc179323b4742bd4d9e18f2b

    • SSDEEP

      1536:Td2vVBczxcYZv3RodgTONZm99V7K6arNsA5M0X8zhQNkSpPEGMdSGkM:B2X8b+qmZmbV7PaWA5H1Tc

    • Phemedrone

      An information and wallet stealer written in C#.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks