Overview

overview

10

Static

static

10

b9e894c975...90.exe

windows7-x64

10

b9e894c975...90.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20766280323.zip

  • Size

    149KB

  • Sample

    250115-snf9vswnhy

  • MD5

    bd4e8bba13cba1401b03bcb3d118b5bd

  • SHA1

    4effbd6c0d88d464d69ed98f71041db8d202b8f5

  • SHA256

    d4e6f95635003f1aad8ec942e26098e6d6a4b95614cec8179ea51bb3ea6f77ad

  • SHA512

    500d8a7e2f0526cafa45dd664600ff49f7024ef0ae9f73b25b3c3b6b0075f67a118d893c5e8c6b1275434cef611328cd01bd3b367336eebd1ba0e2a40aa32104

  • SSDEEP

    3072:0OZ24/lnJC83kRgHymfAR6kz+nGt1o8COf8uJLISEC9i7s7u/x:bZ24VV3kR72kz+w/V9ISEC9iz/x

Score
10/10
phemedronecredential_accessdiscoverystealer

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7668501460:AAH2A5oRhWUqF_EWSrJaaRppA9RgQdU2iUc/sendDocument

Targets

    • Target

      b9e894c975b74265c0c359706931d61227c1ab7074cdf981d2d4a5ceacda9290

    • Size

      320KB

    • MD5

      4f0990ea72c03f3911be671cbceb7fda

    • SHA1

      d07332f930099c4af178e4c4adcdf166decdce91

    • SHA256

      b9e894c975b74265c0c359706931d61227c1ab7074cdf981d2d4a5ceacda9290

    • SHA512

      903b441d433b39fb8b2d3cfd658261ad2c62d51e5171b0d1cfc37d058a27c946209b2fc1d9ca4ab3ef369753339a6c6d3845e95249d3b77a08caa2099c40e63a

    • SSDEEP

      6144:lKTuj7ot3QBAlFV7evwYkBS7asV24JU71esarL:lJjs3QBqFV7YlV674H

    Score
    10/10
    phemedronediscoverystealercredential_access

    • Phemedrone

      An information and wallet stealer written in C#.

      stealerphemedrone

    • Phemedrone family

      phemedrone

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks