phemedrone

General

Target

v1.3.3.0.exe
Size

127.5MB
Sample

240823-hy2nfatclj
MD5

41c5b3cfa0a3f5dfddfe5ac7321051de
SHA1

39a5ddf6f2ee8d0af3a6098f30110f1120309d9e
SHA256

40b828cd407aff07e66bbcf97a9f782d673a2a086494f7b07ae04d9d77c30341
SHA512

c130226867922e5ada1f7ac55b3ec3da9c4eefdc8cf70402306c41838772d69fce59ca9bbedad6d7f3de2beeab97276c678df857e68e6c4b46d1695023198357
SSDEEP

3145728:8XWxt9yEdZsfJtVzwS92RjOUbK1MXzzJFW4FTPe9eMx/vPv:8XWxt9SfqS9S7KaDzJFxTPUeMx/v

Score

10^/10

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6766891578:AAE47sIyviQ0_skRFQtvxeYcndg1C8RFyo4/sendDocument

Extracted

Family

xworm

Version

3.0

C2

david-florist.gl.at.ply.gg:34674

Attributes

Install_directory
%Public%
install_file
USB.exe

Targets

- Target
  
  v1.3.3.0.exe
- Size
  
  127.5MB
- MD5
  
  41c5b3cfa0a3f5dfddfe5ac7321051de
- SHA1
  
  39a5ddf6f2ee8d0af3a6098f30110f1120309d9e
- SHA256
  
  40b828cd407aff07e66bbcf97a9f782d673a2a086494f7b07ae04d9d77c30341
- SHA512
  
  c130226867922e5ada1f7ac55b3ec3da9c4eefdc8cf70402306c41838772d69fce59ca9bbedad6d7f3de2beeab97276c678df857e68e6c4b46d1695023198357
- SSDEEP
  
  3145728:8XWxt9yEdZsfJtVzwS92RjOUbK1MXzzJFW4FTPe9eMx/vPv:8XWxt9SfqS9S7KaDzJFxTPUeMx/v
Score

10^/10

phemedrone xworm credential_access execution persistence rat spyware stealer trojan
- Detect Xworm Payload
- Phemedrone
  An information and wallet stealer written in C#.
  stealer phemedrone
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1