phemedrone

General

Target

minty.exe
Size

438KB
Sample

240821-ng2j1ayhrj
MD5

2375624b17828d50bfb4abcbfcae4d99
SHA1

9abbe47e84017ba2e2084dd0a8b43af186075797
SHA256

0ba605ac5b2ee7e27e05847fc73c510264b5184c8645d17eaa68fbd8cfed2b49
SHA512

eae4253835aff30e2cdac51a7abd79a0466c12c80ceea24a7f6b856e5dc711ae710fee92d0a835c8a60a4b7c160551958a57ff32315ade1d91caa568778eca1f
SSDEEP

6144:YKKVG4XLA4q9/9CL7S7Js8jMXsCiG2OI3a1sGJMXsCig9uBWcj:Yzbq9/TFTYX0dOI3Oj2X0GuI

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

3.0

C2

sites-sing.gl.at.ply.gg:61490

Mutex

9j2ptOtYGGbXbFUF

Attributes

Install_directory
%Public%
install_file
USB.exe

aes.plain

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7375773294:AAFZUnpXCxGuVizu2hOj5WMYl9ULnbeqZ6c/sendDocument

Targets

- Target
  
  minty.exe
- Size
  
  438KB
- MD5
  
  2375624b17828d50bfb4abcbfcae4d99
- SHA1
  
  9abbe47e84017ba2e2084dd0a8b43af186075797
- SHA256
  
  0ba605ac5b2ee7e27e05847fc73c510264b5184c8645d17eaa68fbd8cfed2b49
- SHA512
  
  eae4253835aff30e2cdac51a7abd79a0466c12c80ceea24a7f6b856e5dc711ae710fee92d0a835c8a60a4b7c160551958a57ff32315ade1d91caa568778eca1f
- SSDEEP
  
  6144:YKKVG4XLA4q9/9CL7S7Js8jMXsCiG2OI3a1sGJMXsCig9uBWcj:Yzbq9/TFTYX0dOI3Oj2X0GuI
Score

10^/10

phemedrone xworm credential_access execution persistence rat spyware stealer trojan
- Detect Xworm Payload
- Phemedrone
  An information and wallet stealer written in C#.
  stealer phemedrone
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1