Edit tour

Windows Analysis Report
Itaxyhi.exe

Overview

General Information

Sample name:	Itaxyhi.exe
Analysis ID:	1572892
MD5:	78c586522f986994aa77c466c9d678a8
SHA1:	4b9b13c3782ae532a140a33ba673dc65a37aa882
SHA256:	498ac6b747691eb456fc24ac26c3932effca9b46e39740963120f711e72aefc9
Tags:	exeuser-lontze7
Infos:

Detection

Phemedrone Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Generic Stealer

Yara detected Phemedrone Stealer

Yara detected Telegram RAT

.NET source code references suspicious native API functions

AI detected suspicious sample

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Uses the Telegram API (likely for C&C communication)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

Itaxyhi.exe (PID: 6504 cmdline: "C:\Users\user\Desktop\Itaxyhi.exe" MD5: 78C586522F986994AA77C466C9D678A8)

cleanup

Malware Configuration

Threatname: Phemedrone Stealer

{"C2 url": "https://api.telegram.org/bot7105333862:AAE6XaSuAERR5F_VgpAajrgcx8b0mCmMnqM/sendMessage?chat_id=7235624286", "Botnet": "Default", "Tag": "Itaxyhi", "RSA Key": "<?xml version=\"1.0\" ?>\r\n<RSAParameters xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\">\r\n  <Exponent>AQAB</Exponent>\r\n  <Modulus>lcxyXmt8fdbjh92+uk/0LsBudoiTsIlP6MrwR4ojh2qcobQ+tbyJTPfK7unCHlHSPQpaFMCEAH8llB2KDNdl0Ynkw00bAeg9596b5eOgynVeqs9M3qOjCAKQJaHqWq/oKwHkVoxVa5wrr91eTDNw8y4PTO0rDEDiNbAnDs8F6wk=</Modulus>\r\n</RSAParameters>"}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7105333862:AAE6XaSuAERR5F_VgpAajrgcx8b0mCmMnqM/sendMessage"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2152408176.0000000002D72000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000000.00000002.2152408176.0000000002D9D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000000.00000002.2152408176.0000000002C12000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000000.00000002.2152408176.0000000002C12000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GenericStealer_9	Yara detected Generic Stealer	Joe Security
00000000.00000002.2152408176.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
00000000.00000002.2152408176.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
Process Memory Space: Itaxyhi.exe PID: 6504	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
Process Memory Space: Itaxyhi.exe PID: 6504	JoeSecurity_GenericStealer_9	Yara detected Generic Stealer	Joe Security
decrypted.binstr	JoeSecurity_PhemedroneStealer	Yara detected Phemedrone Stealer	Joe Security
decrypted.binstr	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 5 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Itaxyhi.exe	Malware Configuration Extractor: Phemedrone Stealer {"C2 url": "https://api.telegram.org/bot7105333862:AAE6XaSuAERR5F_VgpAajrgcx8b0mCmMnqM/sendMessage?chat_id=7235624286", "Botnet": "Default", "Tag": "Itaxyhi", "RSA Key": "<?xml version=\"1.0\" ?>\r\n<RSAParameters xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\">\r\n <Exponent>AQAB</Exponent>\r\n <Modulus>lcxyXmt8fdbjh92+uk/0LsBudoiTsIlP6MrwR4ojh2qcobQ+tbyJTPfK7unCHlHSPQpaFMCEAH8llB2KDNdl0Ynkw00bAeg9596b5eOgynVeqs9M3qOjCAKQJaHqWq/oKwHkVoxVa5wrr91eTDNw8y4PTO0rDEDiNbAnDs8F6wk=</Modulus>\r\n</RSAParameters>"}
Source: Itaxyhi.exe.6504.0.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7105333862:AAE6XaSuAERR5F_VgpAajrgcx8b0mCmMnqM/sendMessage"}

Multi AV Scanner detection for submitted file

Source: Itaxyhi.exe	ReversingLabs: Detection: 79%
Source: Itaxyhi.exe	Virustotal: Detection: 70%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Itaxyhi.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: Itaxyhi.exe	String decryptor: 7105333862:AAE6XaSuAERR5F_VgpAajrgcx8b0mCmMnqM
Source: Itaxyhi.exe	String decryptor: 7235624286
Source: Itaxyhi.exe	String decryptor: <?xml version="1.0" ?><RSAParameters xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <Exponent>AQAB</Exponent> <Modulus>lcxyXmt8fdbjh92+uk/0LsBudoiTsIlP6MrwR4ojh2qcobQ+tbyJTPfK7unCHlHSPQpaFMCEAH8llB2KDNdl0Ynkw00bAeg9596b5eOgynVeqs9M3qOjCAKQJaHqWq/oKwHkVoxVa5wrr91eTDNw8y4PTO0rDEDiNbAnDs8F6wk=</Modulus></RSAParameters>
Source: Itaxyhi.exe	String decryptor: Default
Source: Itaxyhi.exe	String decryptor: Itaxyhi
Source: Itaxyhi.exe	String decryptor: Memirybesohutifojyxifyloxaledoc
Source: Itaxyhi.exe	String decryptor: Passwords.txt
Source: Itaxyhi.exe	String decryptor:
Source: Itaxyhi.exe	String decryptor: Messengers/Discord/Tokens.txt
Source: Itaxyhi.exe	String decryptor:
Source: Itaxyhi.exe	String decryptor: Google Accounts/Tokens.txt
Source: Itaxyhi.exe	String decryptor: wallet.dat
Source: Itaxyhi.exe	String decryptor: Wallets/
Source: Itaxyhi.exe	String decryptor: \
Source: Itaxyhi.exe	String decryptor: Armory
Source: Itaxyhi.exe	String decryptor: Atomic
Source: Itaxyhi.exe	String decryptor: atomic\Local Storage\leveldb
Source: Itaxyhi.exe	String decryptor: Bytecoin
Source: Itaxyhi.exe	String decryptor: bytecoin
Source: Itaxyhi.exe	String decryptor: Coninomi
Source: Itaxyhi.exe	String decryptor: Coinomi\Coinomi\wallets
Source: Itaxyhi.exe	String decryptor: Jaxx
Source: Itaxyhi.exe	String decryptor: com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb
Source: Itaxyhi.exe	String decryptor: Electrum
Source: Itaxyhi.exe	String decryptor: Electrum\wallets
Source: Itaxyhi.exe	String decryptor: Exodus
Source: Itaxyhi.exe	String decryptor: Exodus\exodus.wallet
Source: Itaxyhi.exe	String decryptor: Guarda
Source: Itaxyhi.exe	String decryptor: Guarda\Local Storage\leveldb
Source: Itaxyhi.exe	String decryptor: ZCash
Source: Itaxyhi.exe	String decryptor: Zcash
Source: Itaxyhi.exe	String decryptor: /
Source: Itaxyhi.exe	String decryptor: FileZilla\recentservers.xml
Source: Itaxyhi.exe	String decryptor: FileZilla\sitemanager.xml
Source: Itaxyhi.exe	String decryptor: FileZilla\
Source: Itaxyhi.exe	String decryptor: FTP/
Source: Itaxyhi.exe	String decryptor: Profiles
Source: Itaxyhi.exe	String decryptor: key3.db
Source: Itaxyhi.exe	String decryptor: key4.db
Source: Itaxyhi.exe	String decryptor: cookies.sqlite
Source: Itaxyhi.exe	String decryptor: moz_cookies
Source: Itaxyhi.exe	String decryptor: formhistory.sqlite
Source: Itaxyhi.exe	String decryptor: moz_formhistory
Source: Itaxyhi.exe	String decryptor: Browser Data/
Source: Itaxyhi.exe	String decryptor: /Cookies[
Source: Itaxyhi.exe	String decryptor: ].txt
Source: Itaxyhi.exe	String decryptor:
Source: Itaxyhi.exe	String decryptor: /AutoFills[
Source: Itaxyhi.exe	String decryptor:
Source: Itaxyhi.exe	String decryptor: logins.json
Source: Itaxyhi.exe	String decryptor: encryptedUsername
Source: Itaxyhi.exe	String decryptor: encryptedPassword
Source: Itaxyhi.exe	String decryptor: hostname
Source: Itaxyhi.exe	String decryptor: [^ -]
Source: Itaxyhi.exe	String decryptor:
Source: Itaxyhi.exe	String decryptor: 1
Source: Itaxyhi.exe	String decryptor: metaData
Source: Itaxyhi.exe	String decryptor: password
Source: Itaxyhi.exe	String decryptor: 2A864886F70D010C050103
Source: Itaxyhi.exe	String decryptor: ISO-8859-1
Source: Itaxyhi.exe	String decryptor: password-check
Source: Itaxyhi.exe	String decryptor: 2A864886F70D01050D
Source: Itaxyhi.exe	String decryptor: nssPrivate
Source: Itaxyhi.exe	String decryptor: -
Source: Itaxyhi.exe	String decryptor: *.ini
Source: Itaxyhi.exe	String decryptor: global-salt
Source: Itaxyhi.exe	String decryptor: Version
Source: Itaxyhi.exe	String decryptor: User Data
Source: Itaxyhi.exe	String decryptor: 1.0.0.0
Source: Itaxyhi.exe	String decryptor: Local State
Source: Itaxyhi.exe	String decryptor: Network
Source: Itaxyhi.exe	String decryptor: Cookies
Source: Itaxyhi.exe	String decryptor: cookies
Source: Itaxyhi.exe	String decryptor: Web Data
Source: Itaxyhi.exe	String decryptor: autofill
Source: Itaxyhi.exe	String decryptor: Login Data
Source: Itaxyhi.exe	String decryptor: logins
Source: Itaxyhi.exe	String decryptor: token_service
Source: Itaxyhi.exe	String decryptor: credit_cards
Source: Itaxyhi.exe	String decryptor: Local Storage
Source: Itaxyhi.exe	String decryptor: leveldb
Source: Itaxyhi.exe	String decryptor: CreditCards.txt
Source: Itaxyhi.exe	String decryptor: Profile*
Source: Itaxyhi.exe	String decryptor: Authenticator
Source: Itaxyhi.exe	String decryptor: bhghoamapcdpbohphigoooaddinpkbai
Source: Itaxyhi.exe	String decryptor: EOS Authenticator
Source: Itaxyhi.exe	String decryptor: oeljdldpnmdbchonielidgobddffflal
Source: Itaxyhi.exe	String decryptor: BrowserPass
Source: Itaxyhi.exe	String decryptor: naepdomgkenhinolocfifgehidddafch
Source: Itaxyhi.exe	String decryptor: MYKI
Source: Itaxyhi.exe	String decryptor: bmikpgodpkclnkgmnpphehdgcimmided
Source: Itaxyhi.exe	String decryptor: Splikity
Source: Itaxyhi.exe	String decryptor: jhfjfclepacoldmjmkmdlmganfaalklb
Source: Itaxyhi.exe	String decryptor: CommonKey
Source: Itaxyhi.exe	String decryptor: chgfefjpcobfbnpmiokfjjaglahmnded
Source: Itaxyhi.exe	String decryptor: Zoho Vault
Source: Itaxyhi.exe	String decryptor: igkpcodhieompeloncfnbekccinhapdb
Source: Itaxyhi.exe	String decryptor: Norton Password Manager
Source: Itaxyhi.exe	String decryptor: admmjipmmciaobhojoghlmleefbicajg
Source: Itaxyhi.exe	String decryptor: Avira Password Manager
Source: Itaxyhi.exe	String decryptor: caljgklbbfbcjjanaijlacgncafpegll
Source: Itaxyhi.exe	String decryptor: Trezor Password Manager
Source: Itaxyhi.exe	String decryptor: imloifkgjagghnncjkhggdhalmcnfklk
Source: Itaxyhi.exe	String decryptor: MetaMask
Source: Itaxyhi.exe	String decryptor: nkbihfbeogaeaoehlefnkodbefgpgknn
Source: Itaxyhi.exe	String decryptor: TronLink
Source: Itaxyhi.exe	String decryptor: ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: Itaxyhi.exe	String decryptor: BinanceChain
Source: Itaxyhi.exe	String decryptor: fhbohimaelbohpjbbldcngcnapndodjp
Source: Itaxyhi.exe	String decryptor: Coin98
Source: Itaxyhi.exe	String decryptor: aeachknmefphepccionboohckonoeemg
Source: Itaxyhi.exe	String decryptor: iWallet
Source: Itaxyhi.exe	String decryptor: kncchdigobghenbbaddojjnnaogfppfj
Source: Itaxyhi.exe	String decryptor: Wombat
Source: Itaxyhi.exe	String decryptor: amkmjjmmflddogmhpjloimipbofnfjih
Source: Itaxyhi.exe	String decryptor: NeoLine
Source: Itaxyhi.exe	String decryptor: cphhlgmgameodnhkjdmkpanlelnlohao
Source: Itaxyhi.exe	String decryptor: Terra Station
Source: Itaxyhi.exe	String decryptor: aiifbnbfobpmeekipheeijimdpnlpgpp
Source: Itaxyhi.exe	String decryptor: Keplr
Source: Itaxyhi.exe	String decryptor: dmkamcknogkgcdfhhbddcghachkejeap
Source: Itaxyhi.exe	String decryptor: Sollet
Source: Itaxyhi.exe	String decryptor: fhmfendgdocmcbmfikdcogofphimnkno
Source: Itaxyhi.exe	String decryptor: ICONex
Source: Itaxyhi.exe	String decryptor: flpiciilemghbmfalicajoolhkkenfel
Source: Itaxyhi.exe	String decryptor: KHC
Source: Itaxyhi.exe	String decryptor: hcflpincpppdclinealmandijcmnkbgn
Source: Itaxyhi.exe	String decryptor: TezBox
Source: Itaxyhi.exe	String decryptor: mnfifefkajgofkcjkemidiaecocnkjeh
Source: Itaxyhi.exe	String decryptor: Byone
Source: Itaxyhi.exe	String decryptor: nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: Itaxyhi.exe	String decryptor: OneKey
Source: Itaxyhi.exe	String decryptor: ilbbpajmiplgpehdikmejfemfklpkmke
Source: Itaxyhi.exe	String decryptor: Trust Wallets
Source: Itaxyhi.exe	String decryptor: pknlccmneadmjbkollckpblgaaabameg
Source: Itaxyhi.exe	String decryptor: MetaWallet
Source: Itaxyhi.exe	String decryptor: pfknkoocfefiocadajpngdknmkjgakdg
Source: Itaxyhi.exe	String decryptor: Guarda Wallet
Source: Itaxyhi.exe	String decryptor: fcglfhcjfpkgdppjbglknafgfffkelnm
Source: Itaxyhi.exe	String decryptor: idkppnahnmmggbmfkjhiakkbkdpnmnon
Source: Itaxyhi.exe	String decryptor: JaxxxLiberty
Source: Itaxyhi.exe	String decryptor: mhonjhhcgphdphdjcdoeodfdliikapmj
Source: Itaxyhi.exe	String decryptor: Atomic Wallet
Source: Itaxyhi.exe	String decryptor: bhmlbgebokamljgnceonbncdofmmkedg
Source: Itaxyhi.exe	String decryptor: hieplnfojfccegoloniefimmbfjdgcgp
Source: Itaxyhi.exe	String decryptor: Mycelium
Source: Itaxyhi.exe	String decryptor: pidhddgciaponoajdngciiemcflpnnbg
Source: Itaxyhi.exe	String decryptor: Coinomi
Source: Itaxyhi.exe	String decryptor: blbpgcogcoohhngdjafgpoagcilicpjh
Source: Itaxyhi.exe	String decryptor: GreenAddress
Source: Itaxyhi.exe	String decryptor: gflpckpfdgcagnbdfafmibcmkadnlhpj
Source: Itaxyhi.exe	String decryptor: Edge
Source: Itaxyhi.exe	String decryptor: doljkehcfhidippihgakcihcmnknlphh
Source: Itaxyhi.exe	String decryptor: BRD
Source: Itaxyhi.exe	String decryptor: nbokbjkelpmlgflobbohapifnnenbjlh
Source: Itaxyhi.exe	String decryptor: Samourai Wallet
Source: Itaxyhi.exe	String decryptor: apjdnokplgcjkejimjdfjnhmjlbpgkdi
Source: Itaxyhi.exe	String decryptor: Copay
Source: Itaxyhi.exe	String decryptor: ieedgmmkpkbiblijbbldefkomatsuahh
Source: Itaxyhi.exe	String decryptor: Bread
Source: Itaxyhi.exe	String decryptor: jifanbgejlbcmhbbdbnfbfnlmbomjedj
Source: Itaxyhi.exe	String decryptor: KeepKey
Source: Itaxyhi.exe	String decryptor: dojmlmceifkfgkgeejemfciibjehhdcl
Source: Itaxyhi.exe	String decryptor: Trezor
Source: Itaxyhi.exe	String decryptor: jpxupxjxheguvfyhfhahqvxvyqthiryh
Source: Itaxyhi.exe	String decryptor: Ledger Live
Source: Itaxyhi.exe	String decryptor: pfkcfdjnlfjcmkjnhcbfhfkkoflnhjln
Source: Itaxyhi.exe	String decryptor: Ledger Wallet
Source: Itaxyhi.exe	String decryptor: hbpfjlflhnmkddbjdchbbifhllgmmhnm
Source: Itaxyhi.exe	String decryptor: Bitbox
Source: Itaxyhi.exe	String decryptor: ocmfilhakdbncmojmlbagpkjfbmeinbd
Source: Itaxyhi.exe	String decryptor: Digital Bitbox
Source: Itaxyhi.exe	String decryptor: dbhklojmlkgmpihhdooibnmidfpeaing
Source: Itaxyhi.exe	String decryptor: YubiKey
Source: Itaxyhi.exe	String decryptor: mammpjaaoinfelloncbbpomjcihbkmmc
Source: Itaxyhi.exe	String decryptor: Google Authenticator
Source: Itaxyhi.exe	String decryptor: khcodhlfkpmhibicdjjblnkgimdepgnd
Source: Itaxyhi.exe	String decryptor: Microsoft Authenticator
Source: Itaxyhi.exe	String decryptor: bfbdnbpibgndpjfhonkflpkijfapmomn
Source: Itaxyhi.exe	String decryptor: Authy
Source: Itaxyhi.exe	String decryptor: gjffdbjndmcafeoehgdldobgjmlepcal
Source: Itaxyhi.exe	String decryptor: Duo Mobile
Source: Itaxyhi.exe	String decryptor: eidlicjlkaiefdbgmdepmmicpbggmhoj
Source: Itaxyhi.exe	String decryptor: OTP Auth
Source: Itaxyhi.exe	String decryptor: bobfejfdlhnabgglompioclndjejolch
Source: Itaxyhi.exe	String decryptor: FreeOTP
Source: Itaxyhi.exe	String decryptor: elokfmmmjbadpgdjmgglocapdckdcpkn
Source: Itaxyhi.exe	String decryptor: Aegis Authenticator
Source: Itaxyhi.exe	String decryptor: ppdjlkfkedmidmclhakfncpfdmdgmjpm
Source: Itaxyhi.exe	String decryptor: LastPass Authenticator
Source: Itaxyhi.exe	String decryptor: cfoajccjibkjhbdjnpkbananbejpkkjb
Source: Itaxyhi.exe	String decryptor: Dashlane
Source: Itaxyhi.exe	String decryptor: flikjlpgnpcjdienoojmgliechmmheek
Source: Itaxyhi.exe	String decryptor: Keeper
Source: Itaxyhi.exe	String decryptor: gofhklgdnbnpcdigdgkgfobhhghjmmkj
Source: Itaxyhi.exe	String decryptor: RoboForm
Source: Itaxyhi.exe	String decryptor: hppmchachflomkejbhofobganapojjol
Source: Itaxyhi.exe	String decryptor: KeePass
Source: Itaxyhi.exe	String decryptor: lbfeahdfdkibininjgejjgpdafeopflb
Source: Itaxyhi.exe	String decryptor: KeePassXC
Source: Itaxyhi.exe	String decryptor: kgeohlebpjgcfiidfhhdlnnkhefajmca
Source: Itaxyhi.exe	String decryptor: Bitwarden
Source: Itaxyhi.exe	String decryptor: inljaljiffkdgmlndjkdiepghpolcpki
Source: Itaxyhi.exe	String decryptor: NordPass
Source: Itaxyhi.exe	String decryptor: njgnlkhcjgmjfnfahdmfkalpjcneebpl
Source: Itaxyhi.exe	String decryptor: LastPass
Source: Itaxyhi.exe	String decryptor: gabedfkgnbglfbnplfpjddgfnbibkmbb
Source: Itaxyhi.exe	String decryptor: Nifty Wallet
Source: Itaxyhi.exe	String decryptor: jbdaocneiiinmjbjlgalhcelgbejmnid
Source: Itaxyhi.exe	String decryptor: Math Wallet
Source: Itaxyhi.exe	String decryptor: afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: Itaxyhi.exe	String decryptor: Coinbase Wallet
Source: Itaxyhi.exe	String decryptor: hnfanknocfeofbddgcijnmhnfnkdnaad
Source: Itaxyhi.exe	String decryptor: Equal Wallet
Source: Itaxyhi.exe	String decryptor: blnieiiffboillknjnepogjhkgnoac
Source: Itaxyhi.exe	String decryptor: EVER Wallet
Source: Itaxyhi.exe	String decryptor: cgeeodpfagjceefieflmdfphplkenlfk
Source: Itaxyhi.exe	String decryptor: Jaxx Liberty
Source: Itaxyhi.exe	String decryptor: ocefimbphcgjaahbclemolcmkeanoagc
Source: Itaxyhi.exe	String decryptor: BitApp Wallet
Source: Itaxyhi.exe	String decryptor: fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: Itaxyhi.exe	String decryptor: Mew CX
Source: Itaxyhi.exe	String decryptor: nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: Itaxyhi.exe	String decryptor: GU Wallet
Source: Itaxyhi.exe	String decryptor: nfinomegcaccbhchhgflladpfbajihdf
Source: Itaxyhi.exe	String decryptor: Guild Wallet
Source: Itaxyhi.exe	String decryptor: nanjmdkhkinifnkgdeggcnhdaammmj
Source: Itaxyhi.exe	String decryptor: Saturn Wallet
Source: Itaxyhi.exe	String decryptor: nkddgncdjgifcddamgcmfnlhccnimig
Source: Itaxyhi.exe	String decryptor: Harmony Wallet
Source: Itaxyhi.exe	String decryptor: fnnegphlobjdpkhecapkijjdkgcjhkib
Source: Itaxyhi.exe	String decryptor: TON Wallet
Source: Itaxyhi.exe	String decryptor: nphplpgoakhhjchkkhmiggakijnkhfnd
Source: Itaxyhi.exe	String decryptor: OpenMask Wallet
Source: Itaxyhi.exe	String decryptor: penjlddjkjgpnkllboccdgccekpkcbin
Source: Itaxyhi.exe	String decryptor: MyTonWallet
Source: Itaxyhi.exe	String decryptor: fldfpgipfncgndfolcbkdeeknbbbnhcc
Source: Itaxyhi.exe	String decryptor: DeWallet
Source: Itaxyhi.exe	String decryptor: pnccjgokhbnggghddhahcnaopgeipafg
Source: Itaxyhi.exe	String decryptor: TrustWallet
Source: Itaxyhi.exe	String decryptor: egjidjbpglichdcondbcbdnbeeppgdph
Source: Itaxyhi.exe	String decryptor: NC Wallet
Source: Itaxyhi.exe	String decryptor: imlcamfeniaidioeflifonfjeeppblda
Source: Itaxyhi.exe	String decryptor: Moso Wallet
Source: Itaxyhi.exe	String decryptor: ajkifnllfhikkjbjopkhmjoieikeihjb
Source: Itaxyhi.exe	String decryptor: Enkrypt Wallet
Source: Itaxyhi.exe	String decryptor: kkpllkodjeloidieedojogacfhpaihoh
Source: Itaxyhi.exe	String decryptor: CirusWeb3 Wallet
Source: Itaxyhi.exe	String decryptor: kgdijkcfiglijhaglibaidbipiejjfdp
Source: Itaxyhi.exe	String decryptor: Martian and Sui Wallet
Source: Itaxyhi.exe	String decryptor: efbglgofoippbgcjepnhiblaibcnclgk
Source: Itaxyhi.exe	String decryptor: SubWallet
Source: Itaxyhi.exe	String decryptor: onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: Itaxyhi.exe	String decryptor: Pontem Wallet
Source: Itaxyhi.exe	String decryptor: phkbamefinggmakgklpkljjmgibohnba
Source: Itaxyhi.exe	String decryptor: Talisman Wallet
Source: Itaxyhi.exe	String decryptor: fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: Itaxyhi.exe	String decryptor: Kardiachain Wallet
Source: Itaxyhi.exe	String decryptor: pdadjkfkgcafgbceimcpbkalnfnepbnk
Source: Itaxyhi.exe	String decryptor: Phantom Wallet
Source: Itaxyhi.exe	String decryptor: bfnaelmomeimhIpmgjnjophhpkkoljpa
Source: Itaxyhi.exe	String decryptor: Oxygen Wallet
Source: Itaxyhi.exe	String decryptor: fhilaheimglignddjgofkcbgekhenbh
Source: Itaxyhi.exe	String decryptor: PaliWallet
Source: Itaxyhi.exe	String decryptor: mgfffbidihjpoaomajlbgchddlicgpn
Source: Itaxyhi.exe	String decryptor: BoltX Wallet
Source: Itaxyhi.exe	String decryptor: aodkkagnadcbobfpggnjeongemjbjca
Source: Itaxyhi.exe	String decryptor: Liquality Wallet
Source: Itaxyhi.exe	String decryptor: kpopkelmapcoipemfendmdghnegimn
Source: Itaxyhi.exe	String decryptor: xDefi Wallet
Source: Itaxyhi.exe	String decryptor: hmeobnffcmdkdcmlb1gagmfpfboieaf
Source: Itaxyhi.exe	String decryptor: Nami Wallet
Source: Itaxyhi.exe	String decryptor: Ipfcbjknijpeeillifnkikgncikgfhdo
Source: Itaxyhi.exe	String decryptor: MaiarDeFi Wallet
Source: Itaxyhi.exe	String decryptor: dngmlblcodfobpdpecaadgfbeggfjfnm
Source: Itaxyhi.exe	String decryptor: MetaMask Edge Wallet
Source: Itaxyhi.exe	String decryptor: ejbalbakoplchlghecdalmeeeajnimhm
Source: Itaxyhi.exe	String decryptor: Goblin Wallet
Source: Itaxyhi.exe	String decryptor: mlbafbjadjidk1bhgopoamemfibcpdfi
Source: Itaxyhi.exe	String decryptor: Braavos Smart Wallet
Source: Itaxyhi.exe	String decryptor: jnlgamecbpmbajjfhmmmlhejkemejdma
Source: Itaxyhi.exe	String decryptor: UniSat Wallet
Source: Itaxyhi.exe	String decryptor: ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: Itaxyhi.exe	String decryptor: OKX Wallet
Source: Itaxyhi.exe	String decryptor: mcohilncbfahbmgdjkbpemcciiolgcge
Source: Itaxyhi.exe	String decryptor: Manta Wallet
Source: Itaxyhi.exe	String decryptor

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
Itaxyhi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Phemedrone Stealer

Threatname: Telegram RAT

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Itaxyhi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Phemedrone Stealer

Threatname: Telegram RAT

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Windows Analysis Report
Itaxyhi.exe