Behavioral task
behavioral1
Sample
Bupyges.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Bupyges.exe
Resource
win10v2004-20240709-en
General
-
Target
Bupyges.exe
-
Size
116KB
-
MD5
7ff72aafd4c957f58521c2cd3b69c811
-
SHA1
85755b0d563450c987ddf3bc006bcf48ee27b961
-
SHA256
9efce9aeeb96e202c9155617a7208a6566511b58a46534d1c9bb12275175dd8a
-
SHA512
7aa3f52c02e13a1a69697bbdfaf1b288adb42205ecdeaf72535aeb0e245f7aaa5fd68a9cb7fe57ed346ba3c95cf99b6be328255bc0a8522325e1b1625bd4b6db
-
SSDEEP
3072:jPFASpM5tNCtxaOSdYxa5zAvMdead8+BVK7RHaJbW:TFvpMd6aOSdYxoAEYad8+nK7RHaJb
Malware Config
Extracted
phemedrone
127.0.0.1:22222
Signatures
-
Phemedrone family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Bupyges.exe
Files
-
Bupyges.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ