Overview

overview

10

Static

static

3

3575d7a347...cs.exe

windows7-x64

7

3575d7a347...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3575d7a34763ac830acebe23a70adc31d14aefcaa7587948794f67ae663bc64b_NeikiAnalytics.exe

  • Size

    467KB

  • Sample

    240702-e6a9nszcpr

  • MD5

    8b18a070fb632bbcdfe00c8a35922470

  • SHA1

    3b44e9ccfe470a70a05ebbf007a4abc928d27d39

  • SHA256

    3575d7a34763ac830acebe23a70adc31d14aefcaa7587948794f67ae663bc64b

  • SHA512

    c90b9a6722407bb5cdaedbfbc297853f2b4bd46368f087c16b988d7683d03ce5f6002a798562512092452ba00bebba0c209a353154642f7ea34596b9ad4296ba

  • SSDEEP

    12288:3B4sNhwBBy9e4/BrrhMfNQJSaEuP7UgajSMq56v5LwLMycuVlGamrplaQLmfhS0h:x4uhygrrhtMu

Score
10/10
phemedronestealer

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7274515778:AAEx4SxiDLjUG8dht4Cac1HVmxqTSwD_yL4/sendDocument

Targets

    • Target

      3575d7a34763ac830acebe23a70adc31d14aefcaa7587948794f67ae663bc64b_NeikiAnalytics.exe

    • Size

      467KB

    • MD5

      8b18a070fb632bbcdfe00c8a35922470

    • SHA1

      3b44e9ccfe470a70a05ebbf007a4abc928d27d39

    • SHA256

      3575d7a34763ac830acebe23a70adc31d14aefcaa7587948794f67ae663bc64b

    • SHA512

      c90b9a6722407bb5cdaedbfbc297853f2b4bd46368f087c16b988d7683d03ce5f6002a798562512092452ba00bebba0c209a353154642f7ea34596b9ad4296ba

    • SSDEEP

      12288:3B4sNhwBBy9e4/BrrhMfNQJSaEuP7UgajSMq56v5LwLMycuVlGamrplaQLmfhS0h:x4uhygrrhtMu

    Score
    10/10
    phemedronestealer

    • Phemedrone

      An information and wallet stealer written in C#.

      stealerphemedrone

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks