General

  • Target

    Resource.exe

  • Size

    137KB

  • Sample

    241114-qhykvayphz

  • MD5

    4f38c635b15d7f9087a758baca7c6662

  • SHA1

    0cbfe507872829dc19e63436fb8e9759dfb42271

  • SHA256

    0404b9addf506f9b143521aed1b3a1003c2c8f16828221946a4d06dac6e85bfd

  • SHA512

    dde8048dc7add02f03196438f171c52e6bd04fe099be061c6f2adcb8ed893d4e9279a823d8bd1c6d506d6f1e1857bb1ff5f5a41292e643db8aa6f025f4a8fddb

  • SSDEEP

    1536:5huxXrW4Heqv3taHo8a+rIq24GPwfWUzL7SWoWicEmDA1wWu0eja5JUrsD98fp4P:5AxbB+maI8aRqhvja5arGef1G5trgE

Malware Config

Extracted

Family

phemedrone

C2

https://mined.to/gate.php

Targets

    • Target

      Resource.exe

    • Size

      137KB

    • MD5

      4f38c635b15d7f9087a758baca7c6662

    • SHA1

      0cbfe507872829dc19e63436fb8e9759dfb42271

    • SHA256

      0404b9addf506f9b143521aed1b3a1003c2c8f16828221946a4d06dac6e85bfd

    • SHA512

      dde8048dc7add02f03196438f171c52e6bd04fe099be061c6f2adcb8ed893d4e9279a823d8bd1c6d506d6f1e1857bb1ff5f5a41292e643db8aa6f025f4a8fddb

    • SSDEEP

      1536:5huxXrW4Heqv3taHo8a+rIq24GPwfWUzL7SWoWicEmDA1wWu0eja5JUrsD98fp4P:5AxbB+maI8aRqhvja5arGef1G5trgE

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks