General

  • Target

    Synapse Z.rar

  • Size

    54KB

  • Sample

    241108-n9nhva1md1

  • MD5

    2c294b9ab51047dadc1326b5e644cd37

  • SHA1

    b3a6fc9d04d7c84e9dc2159b47cd3dcec0228a1f

  • SHA256

    d49b318ebd36d2d80d20a2339f7ad1a8700b4bfcb8e35e56ef2fbe5d470c79a3

  • SHA512

    0b029f0164d26a8d5301b73a8424e516c13840821c6179ab764b86f9642bdfcd2f998dec31b14d44f2b347da4b26f44055c2424ade654d193cca3e6a91391639

  • SSDEEP

    768:P7Dr4PosmPRTRR0Ll/4+D43SKNfe8S3SYyjEouVr4Kg0Qh9yScnPe6EZX7L:PXzQLR4CKlSXvVr4K4hJcnPuZX

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7213845603:AAFFyxsyId9av6CCDVB1BCAM5hKLby41Dr8/sendDocument

Targets

    • Target

      Synapse Z.rar

    • Size

      54KB

    • MD5

      2c294b9ab51047dadc1326b5e644cd37

    • SHA1

      b3a6fc9d04d7c84e9dc2159b47cd3dcec0228a1f

    • SHA256

      d49b318ebd36d2d80d20a2339f7ad1a8700b4bfcb8e35e56ef2fbe5d470c79a3

    • SHA512

      0b029f0164d26a8d5301b73a8424e516c13840821c6179ab764b86f9642bdfcd2f998dec31b14d44f2b347da4b26f44055c2424ade654d193cca3e6a91391639

    • SSDEEP

      768:P7Dr4PosmPRTRR0Ll/4+D43SKNfe8S3SYyjEouVr4Kg0Qh9yScnPe6EZX7L:PXzQLR4CKlSXvVr4K4hJcnPuZX

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Executes dropped EXE

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks