Extracted

• • Target
    2026-05-16_9bc63364494b4a2fa5be28eef859cc05_glassworm_icedid_luca-stealer_njrat_phemedrone-stealer_redline-stealer
  • Size 1.6MB
  • SHA256 806513fe44c1b86fc6ea44d1904cfd6d0e260ec65fb3fe61eb0848c6aa224610
  • MD5 9bc63364494b4a2fa5be28eef859cc05
  • SHA1 5f67b2580f7c862b61ec246e88bcc56bd74c5e05
  • SHA512 a0a6081bc83c3c640e9dfcc985d7043566f5f93c2cb1011dac563d75181c4a2b8c7e26b335cb91d85828aa1617a9d5e1d95a5f9053cfc49372e628d3c64f2e18
  • SSDEEP 24576:ZMDypp7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYn:Zu+toj15e4w8xhACEKzs57Xci5NLd
  • TLSH
    T1B775F14B63E401E7E1F7ED76CC620524EA72B8165AE0E64F079404D64E337D98D2BBA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  phemedronepersistencespywarestealer

  • Family: Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables Discord URL observed in first stage droppers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2