General

  • Target

    system.exe

  • Size

    101KB

  • Sample

    240707-16xzbs1fqb

  • MD5

    fd01a9e88fd110df94b51349094242aa

  • SHA1

    1c944a8d1b7dab69a493b90c4f1a8a24030125e7

  • SHA256

    e2eec42a3c7c489d74b158e1fef336fe1a9d2c7e2ea67a4c6e6a724ffac9b1eb

  • SHA512

    cfe1ca1cef527a09ce8aece7fd92af29ef956ac2fa8869f88075b3b248681d23f5c99a27a49b40a90f86c150f8b6e297ea68c230700bcc22164498fdd262d2d5

  • SSDEEP

    3072:ms/j1ruFB/AYhC0VYY9s9O0hWUyUtV5c5JrK3wEK9ucZ:cHBMM7fREKD

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6861530662:AAFueJRxaIZGz_oVT2-CVuuL9N0MRsh-5_Y/sendMessage?chat_id=-4275222483

Targets

    • Target

      system.exe

    • Size

      101KB

    • MD5

      fd01a9e88fd110df94b51349094242aa

    • SHA1

      1c944a8d1b7dab69a493b90c4f1a8a24030125e7

    • SHA256

      e2eec42a3c7c489d74b158e1fef336fe1a9d2c7e2ea67a4c6e6a724ffac9b1eb

    • SHA512

      cfe1ca1cef527a09ce8aece7fd92af29ef956ac2fa8869f88075b3b248681d23f5c99a27a49b40a90f86c150f8b6e297ea68c230700bcc22164498fdd262d2d5

    • SSDEEP

      3072:ms/j1ruFB/AYhC0VYY9s9O0hWUyUtV5c5JrK3wEK9ucZ:cHBMM7fREKD

    • Phemedrone

      An information and wallet stealer written in C#.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks