phemedrone

General

Target

XBinderOutput.exe
Size

568KB
Sample

240824-t72kkszanf
MD5

43ebcf641eac11f8012145d44733cc0a
SHA1

e1776ddd0a23987ca149e74cccd8e9372b7f27c5
SHA256

c8431f6620fb1f7e2404f33562347d83ad660106659c3143d00f3b699dee454e
SHA512

2379be5b09810007668b11fe58d3d1d575c1f2acd9962803147890a3d32ade8a982584e42d18c08b320043136991014f2f6ed09e8bfb238f555694d859f42aa2
SSDEEP

12288:YP5B0nVtH35fFWAZdfJxLswLlXfUX05oEOj2X0GuI:YP5B0nVnZZJxLxL+SoEl

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

rules-views.at.ply.gg:21974

Mutex

Uf6Nl0qMPg6NLqce

Attributes

Install_directory
%LocalAppData%
install_file
svchost.exe

aes.plain

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7375773294:AAFZUnpXCxGuVizu2hOj5WMYl9ULnbeqZ6c/sendDocument

Targets

- Target
  
  XBinderOutput.exe
- Size
  
  568KB
- MD5
  
  43ebcf641eac11f8012145d44733cc0a
- SHA1
  
  e1776ddd0a23987ca149e74cccd8e9372b7f27c5
- SHA256
  
  c8431f6620fb1f7e2404f33562347d83ad660106659c3143d00f3b699dee454e
- SHA512
  
  2379be5b09810007668b11fe58d3d1d575c1f2acd9962803147890a3d32ade8a982584e42d18c08b320043136991014f2f6ed09e8bfb238f555694d859f42aa2
- SSDEEP
  
  12288:YP5B0nVtH35fFWAZdfJxLswLlXfUX05oEOj2X0GuI:YP5B0nVnZZJxLxL+SoEl
Score

10^/10

phemedrone xworm credential_access execution persistence rat spyware stealer trojan
- Detect Xworm Payload
- Phemedrone
  An information and wallet stealer written in C#.
  stealer phemedrone
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2