General

  • Target

    Icivine.exe

  • Size

    116KB

  • Sample

    250321-2qe91ssvft

  • MD5

    e5e1d6eabea9f77f8d0d5199c2b22c28

  • SHA1

    972ada7e05c033ad254d6be969f4474e87445f0f

  • SHA256

    ca06bac7f08be141fd2524d4b9208d41d8c95d45e790c4ef5f984f1252c2834d

  • SHA512

    d6d1bcbb3571d658b5816126fd5c0fb66d8b8d5b7159a96b2edb53c3b7c1aa13583e17983d0d89e0d43e7030ca6d9faa3ec7ec05b3714d1fcdaf0bc13ed4f585

  • SSDEEP

    1536:cYD01nFGLBQ+Z33RXwvoM0BCh1ic6gYbI5ry7zQNmD0xicTmd1GQeSamw4Dli2sZ:loFFiZ1821gF5iSetAmd1GweN

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7831430177:AAHyPrNHXslwzad7nSAEROdQK02cKzd8JCE/sendDocument

Targets

    • Target

      Icivine.exe

    • Size

      116KB

    • MD5

      e5e1d6eabea9f77f8d0d5199c2b22c28

    • SHA1

      972ada7e05c033ad254d6be969f4474e87445f0f

    • SHA256

      ca06bac7f08be141fd2524d4b9208d41d8c95d45e790c4ef5f984f1252c2834d

    • SHA512

      d6d1bcbb3571d658b5816126fd5c0fb66d8b8d5b7159a96b2edb53c3b7c1aa13583e17983d0d89e0d43e7030ca6d9faa3ec7ec05b3714d1fcdaf0bc13ed4f585

    • SSDEEP

      1536:cYD01nFGLBQ+Z33RXwvoM0BCh1ic6gYbI5ry7zQNmD0xicTmd1GQeSamw4Dli2sZ:loFFiZ1821gF5iSetAmd1GweN

    • Phemedrone

      An information and wallet stealer written in C#.

    • Phemedrone family

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

MITRE ATT&CK Enterprise v15

Tasks