Extracted

• • Target

    slinkyloader.exe

  • Size

    18.5MB

  • MD5

    16c3dea94d76e543f411d4c39c86fd2d

  • SHA1

    c746d6096bbfcf6e5fe1ee1f052ce87ebe2bf0a6

  • SHA256

    3d0136aa999263e36d344cdf9699be53a96872a6cc6a9426bb8fd40133366c3b

  • SHA512

    71d7a55c7bcbdcea7c814981e470a73da9d32d88810b4792e6f2530e8ae453cc06c82587eb5bda70d52d75295d643e8d531bbddd29d838d720757053b1d54726

  • SSDEEP

    393216:svmY2qQIpv7b01MkOYFld5xRwTOu3Uci7OkKprTWlKDtwOju3SLKyiYGLgN:TFUb0WtOlXxG6gUceOkW8KDt5j6QKIP

  Score

  10^/10

  phemedronecredential_accessdefense_evasionspywarestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Phemedrone family

    phemedrone

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2