phemedrone | 201453afc1cceb1da21a6a87a6921cb99d843ae93be6fd8c2c84d4e6cf025c97[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

201453afc1cceb1da21a6a87a6921cb99d843ae93be6fd8c2c84d4e6cf025c97.exe
Size

194KB
MD5

571878c5dbb5200509fddc36d7c01643
SHA1

85812f73a4857c3dbf52f7f33bde08fae9ac730c
SHA256

201453afc1cceb1da21a6a87a6921cb99d843ae93be6fd8c2c84d4e6cf025c97
SHA512

df6af844fe158ee31988a0f49fc20b2a15a9812fb9cb4fec569900a486e5af4ebff84d6db8229f96175ebee7a114c1285e625320342bb61c8aaee9200e6b8e89
SSDEEP

6144:UsbxzQ/mrGZw/uWJbGF7REKQ1TLRSSXBHDUfp90k:fQ+yZw/CM1/RxXB4fp90k

Score

10^/10

phemedrone

Malware Config

Signatures

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Phemedrone family
phemedrone

Files

201453afc1cceb1da21a6a87a6921cb99d843ae93be6fd8c2c84d4e6cf025c97.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:03:8d:b0:bf:e1:b0:ca:33:b3:d4:00:00:00:00:03:8d
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05-05-2022 19:23

Not After

04-05-2023 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:8c:a1:71:a6:70:fa:5e:11:fc:14:5a:10:5a:db:51:80:57:30:82:37:92:d5:37:17:2c:74:76:3c:9b:32:7b
Signer

Actual PE Digest

19:8c:a1:71:a6:70:fa:5e:11:fc:14:5a:10:5a:db:51:80:57:30:82:37:92:d5:37:17:2c:74:76:3c:9b:32:7b

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:03:8d:b0:bf:e1:b0:ca:33:b3:d4:00:00:00:00:03:8dCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

19:8c:a1:71:a6:70:fa:5e:11:fc:14:5a:10:5a:db:51:80:57:30:82:37:92:d5:37:17:2c:74:76:3c:9b:32:7bSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 141KB - Virtual size: 141KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:03:8d:b0:bf:e1:b0:ca:33:b3:d4:00:00:00:00:03:8d
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

19:8c:a1:71:a6:70:fa:5e:11:fc:14:5a:10:5a:db:51:80:57:30:82:37:92:d5:37:17:2c:74:76:3c:9b:32:7b
Signer

.text
Size: 141KB - Virtual size: 141KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B