General

  • Target

    ResoureFile.zip

  • Size

    138KB

  • Sample

    241222-mgxqdavmbl

  • MD5

    6174ba506514ec4b51459759c8d0f0cb

  • SHA1

    4c6340680c3ddaeae06d1a8cd34dfbba2de748c5

  • SHA256

    f22347457dcc1547a18a9aa2526dc2d355b4af14ebc468c0ac56ba1f1084041f

  • SHA512

    799ed2e2ed3837604edd51119424dbc749938a207cd414fa5a709f6b2eef7d9c2195e3b1ffb69a59242190dcf123113b21e895fbee0543e7d74f41abc5729df1

  • SSDEEP

    3072:LLykyx2xrZAoxRwUMlhFoi95j3pyI69Nr3tg+x5:RyKrZAwRwtHFB9Z3pyr3th7

Malware Config

Extracted

Family

phemedrone

C2

https://mined.to/gate.php

Targets

    • Target

      Resource.zip

    • Size

      137KB

    • MD5

      de4eaf5a4da426a0bbfbbe0eb2dd0985

    • SHA1

      61a2fb33f2611dd8d884b7525d85c7ac5f121b1c

    • SHA256

      b5d297464944d519b49b2cf83916b390a7f43f3a7f8bb17b793640b042aaaa43

    • SHA512

      6b585a725954ebba297d3373eca061a43f13b507607f8d2350f2d783a8047c7295354ac65b2c2549d0370255bcfa4e58fd44401c131bcfdc3c133d628041046c

    • SSDEEP

      3072:eLykyx2xrZAoxRwUMlhFoi95j3pyI69Nr3tg+xy:4yKrZAwRwtHFB9Z3pyr3thw

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Executes dropped EXE

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks