Overview

overview

10

Static

static

10

6bb0ac30f5...7f.exe

windows7-x64

10

6bb0ac30f5...7f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6bb0ac30f5b1a96e78f48a8211bfbe06668fdaa114e0eb68637db78d9f255f7f

  • Size

    117KB

  • Sample

    240619-2vmjwszemk

  • MD5

    e438a17127d1a782cee53eb86802c19c

  • SHA1

    86b3dced8d1c5810dffeabf589cdf17c4a1b8c66

  • SHA256

    6bb0ac30f5b1a96e78f48a8211bfbe06668fdaa114e0eb68637db78d9f255f7f

  • SHA512

    ac06d8f99c27f28f02a4157b2185c88d1be534589ae87c3c64645d178f2be3036911658fee35b9187f8f97a9cca113185b2ea795ed0be35fedb2f00e8b24e906

  • SSDEEP

    1536:E6E3DNjzH0AElVrgyWy2dimfbHVSF9Q3uBW6WYreRNFtQ5I7+xvk7QKw6A+K2Scy:YdzfyWy2dimDHI6+hWW8tQ5Hc7ktrZ

Score
10/10
phemedronespywarestealer

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6463285823:AAG9ttZ5JrVbydAJ3QMrKN2tcIPiyLgpSNU/sendDocument

Targets

    • Target

      6bb0ac30f5b1a96e78f48a8211bfbe06668fdaa114e0eb68637db78d9f255f7f

    • Size

      117KB

    • MD5

      e438a17127d1a782cee53eb86802c19c

    • SHA1

      86b3dced8d1c5810dffeabf589cdf17c4a1b8c66

    • SHA256

      6bb0ac30f5b1a96e78f48a8211bfbe06668fdaa114e0eb68637db78d9f255f7f

    • SHA512

      ac06d8f99c27f28f02a4157b2185c88d1be534589ae87c3c64645d178f2be3036911658fee35b9187f8f97a9cca113185b2ea795ed0be35fedb2f00e8b24e906

    • SSDEEP

      1536:E6E3DNjzH0AElVrgyWy2dimfbHVSF9Q3uBW6WYreRNFtQ5I7+xvk7QKw6A+K2Scy:YdzfyWy2dimDHI6+hWW8tQ5Hc7ktrZ

    Score
    10/10
    phemedronespywarestealer

    • Phemedrone

      An information and wallet stealer written in C#.

      stealerphemedrone

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks