General

  • Target

    ResoureFile.zip

  • Size

    138KB

  • Sample

    241216-s57s5stqdy

  • MD5

    6174ba506514ec4b51459759c8d0f0cb

  • SHA1

    4c6340680c3ddaeae06d1a8cd34dfbba2de748c5

  • SHA256

    f22347457dcc1547a18a9aa2526dc2d355b4af14ebc468c0ac56ba1f1084041f

  • SHA512

    799ed2e2ed3837604edd51119424dbc749938a207cd414fa5a709f6b2eef7d9c2195e3b1ffb69a59242190dcf123113b21e895fbee0543e7d74f41abc5729df1

  • SSDEEP

    3072:LLykyx2xrZAoxRwUMlhFoi95j3pyI69Nr3tg+x5:RyKrZAwRwtHFB9Z3pyr3th7

Malware Config

Extracted

Family

phemedrone

C2

https://mined.to/gate.php

Targets

    • Target

      Resource.exe

    • Size

      137KB

    • MD5

      4f38c635b15d7f9087a758baca7c6662

    • SHA1

      0cbfe507872829dc19e63436fb8e9759dfb42271

    • SHA256

      0404b9addf506f9b143521aed1b3a1003c2c8f16828221946a4d06dac6e85bfd

    • SHA512

      dde8048dc7add02f03196438f171c52e6bd04fe099be061c6f2adcb8ed893d4e9279a823d8bd1c6d506d6f1e1857bb1ff5f5a41292e643db8aa6f025f4a8fddb

    • SSDEEP

      1536:5huxXrW4Heqv3taHo8a+rIq24GPwfWUzL7SWoWicEmDA1wWu0eja5JUrsD98fp4P:5AxbB+maI8aRqhvja5arGef1G5trgE

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks