General

  • Target

    5e7933363278d988f02e1ed988262195d83090202118870a79805d8c4463385a

  • Size

    115KB

  • Sample

    250226-ar9fpswqz6

  • MD5

    ca9edfffa9bacb007cd17fe4be5fff4f

  • SHA1

    375dcd6b35b104017bdcbf2e1e54f7819ffe7945

  • SHA256

    5e7933363278d988f02e1ed988262195d83090202118870a79805d8c4463385a

  • SHA512

    6af1140955ee7c92b1344f3d9a68e825cec54af691bc5a01984a5d62eb6a4eba10dfe5db1860a2fe037be48a3a09f004b082ddb0608e54407a51231fa518da61

  • SSDEEP

    1536:IByvtXMLiZV3RXYmDoQu6Kc917750QQ69c6kCs4io6yc1oXPItYx1OpsoScWh+7/:AEtX/VRDoQzKq775DQ6u4I21A

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7939754852:AAFIvtIYgqhJR7MldVWlBpD2jOfic44MJBs/sendDocument

Targets

    • Target

      5e7933363278d988f02e1ed988262195d83090202118870a79805d8c4463385a

    • Size

      115KB

    • MD5

      ca9edfffa9bacb007cd17fe4be5fff4f

    • SHA1

      375dcd6b35b104017bdcbf2e1e54f7819ffe7945

    • SHA256

      5e7933363278d988f02e1ed988262195d83090202118870a79805d8c4463385a

    • SHA512

      6af1140955ee7c92b1344f3d9a68e825cec54af691bc5a01984a5d62eb6a4eba10dfe5db1860a2fe037be48a3a09f004b082ddb0608e54407a51231fa518da61

    • SSDEEP

      1536:IByvtXMLiZV3RXYmDoQu6Kc917750QQ69c6kCs4io6yc1oXPItYx1OpsoScWh+7/:AEtX/VRDoQzKq775DQ6u4I21A

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks