phemedrone | ce51e9cfba7d93f33087420ef736d451e82073885c1e58a45047012a001ab05e | Triage

Analysis

max time kernel
146s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
14-11-2024 18:32

Sharing

Report Analysis Logs

General

Target

Bloxstrap-v2.5.4.exe
Size

137KB
MD5

71e8616b431c7caad0501f14aa1d5c4b
SHA1

b9c1b78ac78b97cdce8785767772f87abd7518f7
SHA256

ce51e9cfba7d93f33087420ef736d451e82073885c1e58a45047012a001ab05e
SHA512

67e0cabde42a8b666767d4d30f026871dbbd28fe9f5b757f3d6dbcab5b29a91a76c98e07b5cde7dc7cec6a61b283641db51a66a05aaf85b81ea8660a94b41715
SSDEEP

3072:TXxaTJLTj48HOaa8Rlu3nrpse5oxxjPjMxQrQav:Vkuarlu3G9zPjMxQrQa

Score

10^/10

phemedrone stealer

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7763022627:AAHjwAW2eiTJ-zQ8x5sgBtZNkRv-nW0dp0o/sendDocument

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone

C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4.exe
"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4.exe"
1⤵
PID:3432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3432-0-0x00007FFE87FF3000-0x00007FFE87FF5000-memory.dmp

Filesize
8KB

Download
memory/3432-1-0x000001DB34E70000-0x000001DB34E98000-memory.dmp

Filesize
160KB

Download