General
-
Target
https://disk.yandex.ru/d/LdNFOFnpJ78Ahw
-
Sample
240723-s8zxpsxfnl
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
https://drive.usercontent.google.com/u/0/uc?id=1uH0vQ_juAop0fqiOEIdPBdq1AMQmvndT&export=download
Extracted
Family
phemedrone
C2
https://api.telegram.org/bot7230260246:AAFy1nkEQHkcEude1v3boXRM_xhzB5HwGJ0/sendDocument
Targets
-
-
Target
https://disk.yandex.ru/d/LdNFOFnpJ78Ahw
Score10/10-
Phemedrone
An information and wallet stealer written in C#.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-