General

  • Target

    6f9f9973dc9c24d10c4a5678b48d57780b6399408f20bc8c074a73f86fc0fd88

  • Size

    138KB

  • Sample

    241208-1fslxsyrhm

  • MD5

    67c60845c275b4c27e958c31b2129001

  • SHA1

    9cda03f7fb8b88ac08d61325712a55c34fa3ca86

  • SHA256

    6f9f9973dc9c24d10c4a5678b48d57780b6399408f20bc8c074a73f86fc0fd88

  • SHA512

    72831fd0a4522bcacd03ca1dff78844240aeed2a2f430aaa2f290cb06427d42c03f9b546c980e3331f48156f9b8404daaa6ddfbb16e294006b2f22ebb9e21bb1

  • SSDEEP

    3072:pGyxO6HAjmjaa8OPkVw36ieKn5I3UQ8X/L:FOeAija0kVw9

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7399565450:AAHi_hMDEnRAdqS1R6s83tRv7BKyLi6xLyE/sendDocument

Targets

    • Target

      6f9f9973dc9c24d10c4a5678b48d57780b6399408f20bc8c074a73f86fc0fd88

    • Size

      138KB

    • MD5

      67c60845c275b4c27e958c31b2129001

    • SHA1

      9cda03f7fb8b88ac08d61325712a55c34fa3ca86

    • SHA256

      6f9f9973dc9c24d10c4a5678b48d57780b6399408f20bc8c074a73f86fc0fd88

    • SHA512

      72831fd0a4522bcacd03ca1dff78844240aeed2a2f430aaa2f290cb06427d42c03f9b546c980e3331f48156f9b8404daaa6ddfbb16e294006b2f22ebb9e21bb1

    • SSDEEP

      3072:pGyxO6HAjmjaa8OPkVw36ieKn5I3UQ8X/L:FOeAija0kVw9

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks