General

  • Target

    drop3.exe

  • Size

    138KB

  • Sample

    241117-n3z83azaph

  • MD5

    71b454fd9a0f880e9638d7536dd2e8f8

  • SHA1

    419aed8771f92d703e0336172d77cc51b3a03a48

  • SHA256

    581618e83b12fba97bdf117c1431a73c7c938e0ebfb9a12e8533a33bb9462b50

  • SHA512

    92fa6aa2bb0434ae905d1fa758439dd527c3ab652897f965a408ea056753770bf3b27fbf347ada35592fd5c9997757469ddb96aefc1b68dc7be950ade56c5431

  • SSDEEP

    3072:hGyxO6HAjmjaa8OP/HGIssMATKIBn57N8Agq:NOeAija0/lMATzBju

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7356729349:AAGYccwnhlcwqPllDJyVvJvZ35gbTxqyoOs/sendDocument

Targets

    • Target

      drop3.exe

    • Size

      138KB

    • MD5

      71b454fd9a0f880e9638d7536dd2e8f8

    • SHA1

      419aed8771f92d703e0336172d77cc51b3a03a48

    • SHA256

      581618e83b12fba97bdf117c1431a73c7c938e0ebfb9a12e8533a33bb9462b50

    • SHA512

      92fa6aa2bb0434ae905d1fa758439dd527c3ab652897f965a408ea056753770bf3b27fbf347ada35592fd5c9997757469ddb96aefc1b68dc7be950ade56c5431

    • SSDEEP

      3072:hGyxO6HAjmjaa8OP/HGIssMATKIBn57N8Agq:NOeAija0/lMATzBju

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks