Extracted

• • Target
    Dvgixl
  • Size 11KB
  • SHA256 32a65ab893498c8f729186b23cf19792abf1e7a0a446f57a659ec0469ca063d5
  • MD5 0b47ea8e50e9e2bae7057029b112f4e5
  • SHA1 475d138a2c5fcc6bb15cfb11210bfc0268b73cb3
  • SHA512 f4c7162d7294d7f278208a33c7c89c17bdec07014b6b6de5cbd5e8a1dd2a1a317fc90d85f8e79391680fc5ac0ff23850d88ff2267b93aaf1eead3c6ce878f1c6
  • SSDEEP 96:iMqVAoSlLhqYYPh3Zq36uWlUmtpydeX93aze1VCNRupbL5J8O4laB5My7:zMilLhIJhKYX5kerCNRupjyy7
  • TLSH
    T10332864A0DF680E701A685AA7DB1FD0D6DC5868BC219FC4C32FC90AA1FD7D468DC78A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryphemedronepersistenceprivilege_escalationspywarestealer

  • Family: Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1