General

  • Target

    Bupyges.exe

  • Size

    116KB

  • Sample

    240715-sz14eaxekm

  • MD5

    7ff72aafd4c957f58521c2cd3b69c811

  • SHA1

    85755b0d563450c987ddf3bc006bcf48ee27b961

  • SHA256

    9efce9aeeb96e202c9155617a7208a6566511b58a46534d1c9bb12275175dd8a

  • SHA512

    7aa3f52c02e13a1a69697bbdfaf1b288adb42205ecdeaf72535aeb0e245f7aaa5fd68a9cb7fe57ed346ba3c95cf99b6be328255bc0a8522325e1b1625bd4b6db

  • SSDEEP

    3072:jPFASpM5tNCtxaOSdYxa5zAvMdead8+BVK7RHaJbW:TFvpMd6aOSdYxoAEYad8+nK7RHaJb

Malware Config

Extracted

Family

phemedrone

C2

127.0.0.1:22222

Targets

    • Target

      Bupyges.exe

    • Size

      116KB

    • MD5

      7ff72aafd4c957f58521c2cd3b69c811

    • SHA1

      85755b0d563450c987ddf3bc006bcf48ee27b961

    • SHA256

      9efce9aeeb96e202c9155617a7208a6566511b58a46534d1c9bb12275175dd8a

    • SHA512

      7aa3f52c02e13a1a69697bbdfaf1b288adb42205ecdeaf72535aeb0e245f7aaa5fd68a9cb7fe57ed346ba3c95cf99b6be328255bc0a8522325e1b1625bd4b6db

    • SSDEEP

      3072:jPFASpM5tNCtxaOSdYxa5zAvMdead8+BVK7RHaJbW:TFvpMd6aOSdYxoAEYad8+nK7RHaJb

    • Phemedrone

      An information and wallet stealer written in C#.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks