General

  • Target
    VanishRaider-main.rar
  • Size 61KB
  • Sample250119-vbqzmsxlam
  • SHA256 c39552926a046eca64dab7cafbc9002ae22d592cba749fa03b6416b4a299431d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • phemedrone

C2
  • https://api.telegram.org/bot7213845603:AAFFyxsyId9av6CCDVB1BCAM5hKLby41Dr8/sendDocument

Targets

    • Target
      VanishRaider-main/vanish.exe
    • Size 137KB
    • SHA256 c6487e1da77c82d40628312680ad43343cff5b92462ffeeffed30f46b23625ab
    • MD5 SHA1 SHA512 SSDEEP
    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks