phemedrone | Bloxstrap-v2[.]5[.]4[.]exe | Triage

Sharing

General

Target

Bloxstrap-v2.5.4.exe
Size

137KB
MD5

71e8616b431c7caad0501f14aa1d5c4b
SHA1

b9c1b78ac78b97cdce8785767772f87abd7518f7
SHA256

ce51e9cfba7d93f33087420ef736d451e82073885c1e58a45047012a001ab05e
SHA512

67e0cabde42a8b666767d4d30f026871dbbd28fe9f5b757f3d6dbcab5b29a91a76c98e07b5cde7dc7cec6a61b283641db51a66a05aaf85b81ea8660a94b41715
SSDEEP

3072:TXxaTJLTj48HOaa8Rlu3nrpse5oxxjPjMxQrQav:Vkuarlu3G9zPjMxQrQa

Score

10^/10

phemedrone

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7763022627:AAHjwAW2eiTJ-zQ8x5sgBtZNkRv-nW0dp0o/sendDocument

Signatures

Phemedrone family
phemedrone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Bloxstrap-v2.5.4.exe

Files

Bloxstrap-v2.5.4.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ