General

  • Target

    6bb0ac30f5b1a96e78f48a8211bfbe06668fdaa114e0eb68637db78d9f255f7f

  • Size

    117KB

  • Sample

    240619-2vmjwszemk

  • MD5

    e438a17127d1a782cee53eb86802c19c

  • SHA1

    86b3dced8d1c5810dffeabf589cdf17c4a1b8c66

  • SHA256

    6bb0ac30f5b1a96e78f48a8211bfbe06668fdaa114e0eb68637db78d9f255f7f

  • SHA512

    ac06d8f99c27f28f02a4157b2185c88d1be534589ae87c3c64645d178f2be3036911658fee35b9187f8f97a9cca113185b2ea795ed0be35fedb2f00e8b24e906

  • SSDEEP

    1536:E6E3DNjzH0AElVrgyWy2dimfbHVSF9Q3uBW6WYreRNFtQ5I7+xvk7QKw6A+K2Scy:YdzfyWy2dimDHI6+hWW8tQ5Hc7ktrZ

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6463285823:AAG9ttZ5JrVbydAJ3QMrKN2tcIPiyLgpSNU/sendDocument

Targets

    • Target

      6bb0ac30f5b1a96e78f48a8211bfbe06668fdaa114e0eb68637db78d9f255f7f

    • Size

      117KB

    • MD5

      e438a17127d1a782cee53eb86802c19c

    • SHA1

      86b3dced8d1c5810dffeabf589cdf17c4a1b8c66

    • SHA256

      6bb0ac30f5b1a96e78f48a8211bfbe06668fdaa114e0eb68637db78d9f255f7f

    • SHA512

      ac06d8f99c27f28f02a4157b2185c88d1be534589ae87c3c64645d178f2be3036911658fee35b9187f8f97a9cca113185b2ea795ed0be35fedb2f00e8b24e906

    • SSDEEP

      1536:E6E3DNjzH0AElVrgyWy2dimfbHVSF9Q3uBW6WYreRNFtQ5I7+xvk7QKw6A+K2Scy:YdzfyWy2dimDHI6+hWW8tQ5Hc7ktrZ

    • Phemedrone

      An information and wallet stealer written in C#.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks