General

  • Target

    83937f232fb4ed220ffe996f17016132d39d5d1b15cf039338871a641439d33eN

  • Size

    138KB

  • Sample

    241004-xvgles1dnk

  • MD5

    19b81d33f51a88184418ea44457a9d60

  • SHA1

    c60d106c7fe0441510933c4885e4d9f514463f00

  • SHA256

    83937f232fb4ed220ffe996f17016132d39d5d1b15cf039338871a641439d33e

  • SHA512

    0f08345084a8a01f6e3d913683fd60ed8c7c4698b2cc43fc836650b16813f0b851241ebbebdf0e955f71701b9f84633f46d12e178e8dea82021e8821afaa71fb

  • SSDEEP

    3072:R28SrpYJw+qQdgM3/Q8Ey5ERYKUVsgVWvgpx:n1mQdf3/Q5GKUVpV

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7416805555:AAH0Tesujlq6rLfW6UQv3aidMS7QEFHsZJU/sendDocument

Targets

    • Target

      83937f232fb4ed220ffe996f17016132d39d5d1b15cf039338871a641439d33eN

    • Size

      138KB

    • MD5

      19b81d33f51a88184418ea44457a9d60

    • SHA1

      c60d106c7fe0441510933c4885e4d9f514463f00

    • SHA256

      83937f232fb4ed220ffe996f17016132d39d5d1b15cf039338871a641439d33e

    • SHA512

      0f08345084a8a01f6e3d913683fd60ed8c7c4698b2cc43fc836650b16813f0b851241ebbebdf0e955f71701b9f84633f46d12e178e8dea82021e8821afaa71fb

    • SSDEEP

      3072:R28SrpYJw+qQdgM3/Q8Ey5ERYKUVsgVWvgpx:n1mQdf3/Q5GKUVpV

    • Phemedrone

      An information and wallet stealer written in C#.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks