General

  • Target

    a64d873eb3e1c8a7b8d24ae4c672184feebc77a097477512a6e1c6a513d7ce9c

  • Size

    523KB

  • Sample

    241226-g5jkrsynhj

  • MD5

    e116baef037ea6fc036c7e7c1a7ee0af

  • SHA1

    538a99f12bc452adf4597333efa59e34ae734d02

  • SHA256

    a64d873eb3e1c8a7b8d24ae4c672184feebc77a097477512a6e1c6a513d7ce9c

  • SHA512

    cfbb4f1caf8b4ed8ac912f09800e91580d53c4f4690c079afcdbc9f54e0d0c15a90f14663ec9aad9b7b070d397dcf6299604b5ea8078b87e42d87bfb50bd0bc7

  • SSDEEP

    12288:xXkv+IDc/5I93t7RjTdE+ijuiq3NlHKF0G5LopjF00gQngB57U4zMiR5Z3oc2rcV:xyrwq9dNRlHKF0G5LopjF0qM5TMiR5ZR

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7604180600:AAHwr2u1ZveiHzQQ_yVoPYP2QNFw1punco0/sendDocument

Targets

    • Target

      a64d873eb3e1c8a7b8d24ae4c672184feebc77a097477512a6e1c6a513d7ce9c

    • Size

      523KB

    • MD5

      e116baef037ea6fc036c7e7c1a7ee0af

    • SHA1

      538a99f12bc452adf4597333efa59e34ae734d02

    • SHA256

      a64d873eb3e1c8a7b8d24ae4c672184feebc77a097477512a6e1c6a513d7ce9c

    • SHA512

      cfbb4f1caf8b4ed8ac912f09800e91580d53c4f4690c079afcdbc9f54e0d0c15a90f14663ec9aad9b7b070d397dcf6299604b5ea8078b87e42d87bfb50bd0bc7

    • SSDEEP

      12288:xXkv+IDc/5I93t7RjTdE+ijuiq3NlHKF0G5LopjF00gQngB57U4zMiR5Z3oc2rcV:xyrwq9dNRlHKF0G5LopjF0qM5TMiR5ZR

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks