Extracted

Extracted

• • Target
    SecuriteInfo.com.Trojan-PSW.Win32.Stealer.cifv.26324.32739.exe
  • Size 5.3MB
  • SHA256 8586e26ad8c071ae7aed383edf5bef7e1d48f6e019c05b90eaa0a24e592fafd9
  • MD5 6b69cf13f7d2893d69dfaa7ee310b219
  • SHA1 ea654e62b0a82ed8f4983bceedf1afeedf1a79e8
  • SHA512 3bc88ce6e5293ff8c9dec3639dc3fc918bee6780e89c0d0e739e750cb9aaf686fe04b2ace630fa3d0445aced6e80e0508be69b997cee9496ee17f4dce035bc05
  • SSDEEP 98304:R38h3epzb71QGQCPDbZfx8ayCb7BJ5mjwNwwMeZYobSr+v+Z7OGGdJ:R36sdQmRJ8aycBIGpEogKGGd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  phemedronecredential_accessexecutionspywarestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2