Resubmissions

02-02-2025 10:53

250202-myz7tsykbw 10

02-02-2025 10:47

250202-mvq5raxrhw 10

General

  • Target

    Umovelo 2.exe

  • Size

    115KB

  • Sample

    250202-mvq5raxrhw

  • MD5

    4b505f9c0da945d7505ed40f2d0eb8ae

  • SHA1

    1e49a3f17ff2b4f5c5705a421ac94fda0cde348f

  • SHA256

    1dec93d447770aa7636ea8d8e553b68f28b31ba3d34b8024deed5de7b3d82a27

  • SHA512

    50e015ef7073318e277bf0f8448513cd624bd64fe5fa17d31b127cf1d0ca75a9e6774c4dfe89b9bdea01d0d8cb6dd94c1279e23f7d371c1cf72813b69b4ac8ec

  • SSDEEP

    1536:aw8VfG5Pq8rGZo3RVFdgMVk0fdUPLxcAgOgoCJ176IQNgm53YZBjdIvZmqUNDWi4:3aGRqKToMRdaCJ1OIG5GBjd+aNDHlo

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7977811634:AAEsOS7wUXOBwdgGyVbVwwqu3kCcteKHzoA/sendDocument

Targets

    • Target

      Umovelo 2.exe

    • Size

      115KB

    • MD5

      4b505f9c0da945d7505ed40f2d0eb8ae

    • SHA1

      1e49a3f17ff2b4f5c5705a421ac94fda0cde348f

    • SHA256

      1dec93d447770aa7636ea8d8e553b68f28b31ba3d34b8024deed5de7b3d82a27

    • SHA512

      50e015ef7073318e277bf0f8448513cd624bd64fe5fa17d31b127cf1d0ca75a9e6774c4dfe89b9bdea01d0d8cb6dd94c1279e23f7d371c1cf72813b69b4ac8ec

    • SSDEEP

      1536:aw8VfG5Pq8rGZo3RVFdgMVk0fdUPLxcAgOgoCJ176IQNgm53YZBjdIvZmqUNDWi4:3aGRqKToMRdaCJ1OIG5GBjd+aNDHlo

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks