phemedrone

General

Target

e55c163ede5ac0f0a6dfbe3bac2b68d4dc7384c8e4419b07544838161e3d8067
Size

116KB
Sample

240822-rf21xs1djd
MD5

d7c8c6cd7db04ce18ee9e4a0289afddc
SHA1

d9d9ee56b77a195439208f557b461bb3913cb5cd
SHA256

e55c163ede5ac0f0a6dfbe3bac2b68d4dc7384c8e4419b07544838161e3d8067
SHA512

2adf43b1387803b8dff098881a21ad4afff96a8c6fdd0e1d73d2e502bf05eb35c083b4a0ec317eb1db541e6dea23c9b3ae17bd5b339c5aad641d4e2cd8f24c77
SSDEEP

3072:XsOklG1NOuyUGbDf8OIipwYCBxsU9uLsl:XWlGtyUG3fDIizCBxB9uL

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

3.0

C2

david-florist.gl.at.ply.gg:34674

Attributes

Install_directory
%Public%
install_file
USB.exe

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6766891578:AAE47sIyviQ0_skRFQtvxeYcndg1C8RFyo4/sendDocument

Targets

- Target
  
  e55c163ede5ac0f0a6dfbe3bac2b68d4dc7384c8e4419b07544838161e3d8067
- Size
  
  116KB
- MD5
  
  d7c8c6cd7db04ce18ee9e4a0289afddc
- SHA1
  
  d9d9ee56b77a195439208f557b461bb3913cb5cd
- SHA256
  
  e55c163ede5ac0f0a6dfbe3bac2b68d4dc7384c8e4419b07544838161e3d8067
- SHA512
  
  2adf43b1387803b8dff098881a21ad4afff96a8c6fdd0e1d73d2e502bf05eb35c083b4a0ec317eb1db541e6dea23c9b3ae17bd5b339c5aad641d4e2cd8f24c77
- SSDEEP
  
  3072:XsOklG1NOuyUGbDf8OIipwYCBxsU9uLsl:XWlGtyUG3fDIizCBxB9uL
Score

10^/10

phemedrone xworm credential_access execution persistence rat spyware stealer trojan
- Detect Xworm Payload
- Phemedrone
  An information and wallet stealer written in C#.
  stealer phemedrone
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2