phemedrone

General

Target

35c96710224c62bd8dbfb9a6f65cd524fb54657d8e75f2bc4268530b004c6dc6
Size

291KB
Sample

240910-lj8pzsxajp
MD5

37992d4e5349d0a9275c8d1fe0290591
SHA1

2ea1bb73a8459672c7f8a1133c4edc8040c2c63c
SHA256

35c96710224c62bd8dbfb9a6f65cd524fb54657d8e75f2bc4268530b004c6dc6
SHA512

dc2bd50f573d806c88eba2f599476d431ad3b2c64cf14e058e6df53edd2383d2a8b18e99aeae14af6fbbdec7f14c4403ced2883cb20a93c77515b1ed5fae7d88
SSDEEP

6144:rTiaVHkOlGtyUFB3XjdOwkL1xOJ9NLzof6TUIa1bq/KMw:rXJUFB3zEjLPDf6J

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:19121

goods-flex.gl.at.ply.gg:19121

Attributes

Install_directory
%AppData%
install_file
GoogleUpdateUA.exe

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6766891578:AAE47sIyviQ0_skRFQtvxeYcndg1C8RFyo4/sendDocument

Targets

- Target
  
  35c96710224c62bd8dbfb9a6f65cd524fb54657d8e75f2bc4268530b004c6dc6
- Size
  
  291KB
- MD5
  
  37992d4e5349d0a9275c8d1fe0290591
- SHA1
  
  2ea1bb73a8459672c7f8a1133c4edc8040c2c63c
- SHA256
  
  35c96710224c62bd8dbfb9a6f65cd524fb54657d8e75f2bc4268530b004c6dc6
- SHA512
  
  dc2bd50f573d806c88eba2f599476d431ad3b2c64cf14e058e6df53edd2383d2a8b18e99aeae14af6fbbdec7f14c4403ced2883cb20a93c77515b1ed5fae7d88
- SSDEEP
  
  6144:rTiaVHkOlGtyUFB3XjdOwkL1xOJ9NLzof6TUIa1bq/KMw:rXJUFB3zEjLPDf6J
Score

10^/10

phemedrone xworm credential_access execution persistence rat spyware stealer trojan
- Detect Xworm Payload
- Phemedrone
  An information and wallet stealer written in C#.
  stealer phemedrone
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2