General

  • Target

    10273f0f52aecaaf9688f7bbc250bc1e75c3cfd054831c78fffadadfb65d07a6.exe

  • Size

    235KB

  • Sample

    241105-csbxya1rdv

  • MD5

    0ff0576f91e4f548ca0d223462b2586c

  • SHA1

    d9d79541127febdb03e0c0de663d42b4b33fead9

  • SHA256

    10273f0f52aecaaf9688f7bbc250bc1e75c3cfd054831c78fffadadfb65d07a6

  • SHA512

    0c41762e9967aac27f9d064ef89e6c8cc145d906fcfa1f6420add3bc13e0b8d4c6fe62e828aec555722f90a98b7b6cba73ec3799ebf1d0a40fab3f191bdad1e2

  • SSDEEP

    1536:BmDUeGs1J7fIwquWnkJwXkbLV6ZmB9IADS1u0TjfZ3LWj3Le5eRjIIVwObSqI+nU:MDx1J7fIwpq+8KAh3LAEctWO3/ET

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot8091768794:AAFZsJ1h-6BiszgyLm-eH6c-uITQ7Z99Wbc/sendDocument

Targets

    • Target

      10273f0f52aecaaf9688f7bbc250bc1e75c3cfd054831c78fffadadfb65d07a6.exe

    • Size

      235KB

    • MD5

      0ff0576f91e4f548ca0d223462b2586c

    • SHA1

      d9d79541127febdb03e0c0de663d42b4b33fead9

    • SHA256

      10273f0f52aecaaf9688f7bbc250bc1e75c3cfd054831c78fffadadfb65d07a6

    • SHA512

      0c41762e9967aac27f9d064ef89e6c8cc145d906fcfa1f6420add3bc13e0b8d4c6fe62e828aec555722f90a98b7b6cba73ec3799ebf1d0a40fab3f191bdad1e2

    • SSDEEP

      1536:BmDUeGs1J7fIwquWnkJwXkbLV6ZmB9IADS1u0TjfZ3LWj3Le5eRjIIVwObSqI+nU:MDx1J7fIwpq+8KAh3LAEctWO3/ET

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks