General

  • Target

    Temykok.exe

  • Size

    138KB

  • Sample

    250120-g5jwjavrgy

  • MD5

    d019e04c6c70e8fb44dd3dfe0a487411

  • SHA1

    19820dcd467a0b0d8e70d0aa8cbb3004de9faa6c

  • SHA256

    0f440a7745bfbba3947f5a104dab6f3e1ad202ff5a99d63ab53762161964305a

  • SHA512

    aa3d70055bff36220da5735581057763d20e02021a99c1f733a58b949672b7eef43d52f9d6a5418cfe14a8d87ead5ba2708a9cbb1f77024d7f3998b743a08e6e

  • SSDEEP

    3072:UHx8zR4oJ8byNKS+qHXwTs/8H1lsm53hvHcRAlY+Ejv/WQA:Ag4ycS+ggKCpvuNRjvF

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot8185640178:AAEe-sIhlh5lPD_qjEnaSBnrB-YWsmO-Jcg/sendDocument

Targets

    • Target

      Temykok.exe

    • Size

      138KB

    • MD5

      d019e04c6c70e8fb44dd3dfe0a487411

    • SHA1

      19820dcd467a0b0d8e70d0aa8cbb3004de9faa6c

    • SHA256

      0f440a7745bfbba3947f5a104dab6f3e1ad202ff5a99d63ab53762161964305a

    • SHA512

      aa3d70055bff36220da5735581057763d20e02021a99c1f733a58b949672b7eef43d52f9d6a5418cfe14a8d87ead5ba2708a9cbb1f77024d7f3998b743a08e6e

    • SSDEEP

      3072:UHx8zR4oJ8byNKS+qHXwTs/8H1lsm53hvHcRAlY+Ejv/WQA:Ag4ycS+ggKCpvuNRjvF

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks