Extracted

• • Target

    fix.exe

  • Size

    182KB

  • MD5

    c051fba1ccd26b26c6052d9d83af4ef7

  • SHA1

    f05973654803099ed3579f90e4ec2febc893d86f

  • SHA256

    971a5e7ce8ea5ec0daba3818240f241e7ef73c7b26f876fb90faa989427e8de7

  • SHA512

    1c01641f92bb291b79c49aac8a1a3c42725c82650e56bb6e741b0d399df477eb295ddf3dbdf79de76dcb7949de9637bc60bab204cbfdb90889f0ec317162ce5c

  • SSDEEP

    3072:ACUln0JMvzUD7CSCMIP8PMJDQe5SOmrc0i/HBAx4EuiLaOmf9hvQO541gMhKFziu:AT0JpD70P8PMJ83rJaBOQ1d5nMhKxiko

  Score

  10^/10

  phemedronecredential_accessdiscoveryexecutionpersistencespywarestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Phemedrone family

    phemedrone

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2