General

  • Target

    qqnal04.exe

  • Size

    122KB

  • Sample

    250115-ps3f4sspbv

  • MD5

    b63e93f067d727c983c46012f35647d4

  • SHA1

    07591cf86732d0e0b1f822eef2147c24bda77df3

  • SHA256

    eebb47c48137f331e9e7e203763300c343a3643f88c60318667b5d525c40a058

  • SHA512

    1d21215f2576df3197ba26a4e139e89b9fc72a2337ac641495d946aedb0bb416da9513d9feafbd4201e3b6dc89165623016d9e992032cfdbd417c37363f4a9d5

  • SSDEEP

    1536:gE6Md2HIvcb2jJFEhFyYwDXEqECixQ7+5M9eNSarewEKweuH4Xjt/0g:gEhzcajJJYwrhTw5weYaKwEKtu8jN0g

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7105371916:AAHmKYUFBY4gzPciIZ6nC4H-7mczREtwqxk/sendMessage?chat_id=8013500311

Targets

    • Target

      qqnal04.exe

    • Size

      122KB

    • MD5

      b63e93f067d727c983c46012f35647d4

    • SHA1

      07591cf86732d0e0b1f822eef2147c24bda77df3

    • SHA256

      eebb47c48137f331e9e7e203763300c343a3643f88c60318667b5d525c40a058

    • SHA512

      1d21215f2576df3197ba26a4e139e89b9fc72a2337ac641495d946aedb0bb416da9513d9feafbd4201e3b6dc89165623016d9e992032cfdbd417c37363f4a9d5

    • SSDEEP

      1536:gE6Md2HIvcb2jJFEhFyYwDXEqECixQ7+5M9eNSarewEKweuH4Xjt/0g:gEhzcajJJYwrhTw5weYaKwEKtu8jN0g

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks