General

  • Target

    17dc04583909d5099fcd9832f74829213814c9c33dd2d46fe6147d70b67a44dd

  • Size

    115KB

  • Sample

    250112-yblxgawlcz

  • MD5

    42ba83c1d55d951c888242c07569aa73

  • SHA1

    e5f25a393bf97ff0ecf34d6c841258faee91bf1a

  • SHA256

    17dc04583909d5099fcd9832f74829213814c9c33dd2d46fe6147d70b67a44dd

  • SHA512

    dfe88650f7ebfff111da8d134a81a4b516c6c6accf798abe96cce4cb6fae53127df2eb9d539b2681ee0d450b323a10ed94276eaf435f0d930e675351be707a9e

  • SSDEEP

    1536:I6BvtXMLiZl3Rf8ZFk96RLj316YWXNnIgb5AqF9pHfKjVIJZIMZXCL9KEED:jFtXDpSF+OLYYW9b5frtKjhU

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7347431896:AAHSmJbR78XbL3aFwhb-k89soitUyeZV0x4/sendDocument

Targets

    • Target

      17dc04583909d5099fcd9832f74829213814c9c33dd2d46fe6147d70b67a44dd

    • Size

      115KB

    • MD5

      42ba83c1d55d951c888242c07569aa73

    • SHA1

      e5f25a393bf97ff0ecf34d6c841258faee91bf1a

    • SHA256

      17dc04583909d5099fcd9832f74829213814c9c33dd2d46fe6147d70b67a44dd

    • SHA512

      dfe88650f7ebfff111da8d134a81a4b516c6c6accf798abe96cce4cb6fae53127df2eb9d539b2681ee0d450b323a10ed94276eaf435f0d930e675351be707a9e

    • SSDEEP

      1536:I6BvtXMLiZl3Rf8ZFk96RLj316YWXNnIgb5AqF9pHfKjVIJZIMZXCL9KEED:jFtXDpSF+OLYYW9b5frtKjhU

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks