General

  • Target

    file.exe

  • Size

    138KB

  • Sample

    241030-1rlyhszrhy

  • MD5

    cae3f7ae06655eb93f5dfb028ddd3d6d

  • SHA1

    54821b16fab00ec529f0b99e1d49de8d291eb492

  • SHA256

    1fc74fb83aebbe5a37b41e7a4e900a83288618ca696d76a717e2d6a51fad343f

  • SHA512

    e2226e3ba2c9bd079db74dcc0cb87f8d6449c99dfe3d2ccae0dda40b7c1a1ca3b77341e49c72bbb183aca86fd29960a70836bfb758f42c3bf83605b3f808dad8

  • SSDEEP

    1536:6KQx+JZ4AV5zOvv24ajo8OFbebA+fnnlNWu0SBs54K4UAfJw1oKrY14a9ilmdz82:6RxSdvzODaM8Olevnlp65mJw1bpuMuf

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6217988193:AAFiJwdcFHDuCM08fAA_dnBQZGLDPSVjUQY/sendDocument

Targets

    • Target

      file.exe

    • Size

      138KB

    • MD5

      cae3f7ae06655eb93f5dfb028ddd3d6d

    • SHA1

      54821b16fab00ec529f0b99e1d49de8d291eb492

    • SHA256

      1fc74fb83aebbe5a37b41e7a4e900a83288618ca696d76a717e2d6a51fad343f

    • SHA512

      e2226e3ba2c9bd079db74dcc0cb87f8d6449c99dfe3d2ccae0dda40b7c1a1ca3b77341e49c72bbb183aca86fd29960a70836bfb758f42c3bf83605b3f808dad8

    • SSDEEP

      1536:6KQx+JZ4AV5zOvv24ajo8OFbebA+fnnlNWu0SBs54K4UAfJw1oKrY14a9ilmdz82:6RxSdvzODaM8Olevnlp65mJw1bpuMuf

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks