Extracted

• • Target

    86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354.exe

  • Size

    14.2MB

  • MD5

    c5d36c7404a03ec6df8024737d97a0c8

  • SHA1

    9a213e487337376c38e0cfdac240dc6ffb5fdc1e

  • SHA256

    86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354

  • SHA512

    812a21f479c56716d892df32a1f910b41310f74de13641d93654a0a722705fb90e114081f2af2ef8c4717febb05715183c0d6deb36bb135f819553c9a9e49216

  • SSDEEP

    196608:MUehdkSzJ4bvuLE5rUSW9rWWsPbWIBMWRlHbLVb4zH:M94x5r1CrWWsTWIfN8

  Score

  10^/10

  executionphemedronestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Phemedrone family

    phemedrone

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Executes dropped EXE

  behavioral1behavioral2