General

  • Target

    74ecb7643208d61941bc5df09bf5c02a69967123a69abf0910fb3cee47f8736d.exe

  • Size

    137KB

  • Sample

    241230-wj8ebsvkbv

  • MD5

    1e4824980163b6ccef09063145175e40

  • SHA1

    33d50b6899535ed590e59c0d3612b518f1c8bb43

  • SHA256

    74ecb7643208d61941bc5df09bf5c02a69967123a69abf0910fb3cee47f8736d

  • SHA512

    f1e1f0e66c8feb520a0866d80b20dcf8e036afdfdcb4e2382bbec354647d13d56b7d1bab93e6c8b0b2708d9c86b3c119ebf9b763c9a80071cd9bcc49e0ab876f

  • SSDEEP

    3072:/GH2azxm8xzWtlnEaaXi8LvgXENeT5LisfoHdVAZrJk:im0ivahvDeRdfIdVAZi

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7679208534:AAFMsY7JAxbOiRUA13LWWn4FVaRbHH1x-tE/sendDocument

Targets

    • Target

      74ecb7643208d61941bc5df09bf5c02a69967123a69abf0910fb3cee47f8736d.exe

    • Size

      137KB

    • MD5

      1e4824980163b6ccef09063145175e40

    • SHA1

      33d50b6899535ed590e59c0d3612b518f1c8bb43

    • SHA256

      74ecb7643208d61941bc5df09bf5c02a69967123a69abf0910fb3cee47f8736d

    • SHA512

      f1e1f0e66c8feb520a0866d80b20dcf8e036afdfdcb4e2382bbec354647d13d56b7d1bab93e6c8b0b2708d9c86b3c119ebf9b763c9a80071cd9bcc49e0ab876f

    • SSDEEP

      3072:/GH2azxm8xzWtlnEaaXi8LvgXENeT5LisfoHdVAZrJk:im0ivahvDeRdfIdVAZi

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks