# Phemedrone Stealer

**URL:** <https://community.emergingthreats.net/t/phemedrone-stealer/838>\
**Category:** Rule Signatures\
**Created:** [August 4, 2023, 7:33am UTC](https://community.emergingthreats.net/t/phemedrone-stealer/838 "2023-08-04T07:33:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [August 4, 2023, 7:33am UTC](https://community.emergingthreats.net/t/phemedrone-stealer/838/1 "2023-08-04T07:33:58Z")

</div>

Hello, I propose a rule for phemedron stealer. Exfiltation is carried out through telegram.

> **[Analysis RUST-By-OriZZ.exe (MD5: 8B212231BCE5312E24CE1C2417F40630) Malicious...](https://app.any.run/tasks/e70a994d-6a38-483e-99ad-b9ddbfe1b9b7/)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/1X/5282d1c14a3bb11e2993f1275bb9859d07bece00.png)

```auto
alert http any any -> any any (msg: "ET MALWARE [ANY.RUN] Phemedrone Stealer Exfiltration";
flow: established, to_server;
http.method; 
content: "GET"; 
http.uri;
content: "/bot"; depth: 4;
content: "sendDocument"; distance: 0;
http.host;
content: "api.telegram.org"; 
http.request_body;
content: "-Phemedrone-Report.phem|22|"; depth: 1024; 
classtype: credential-theft;
reference: md5,8b212231bce5312e24ce1c2417f40630;
reference: url,app.any.run/tasks/e70a994d-6a38-483e-99ad-b9ddbfe1b9b7/;
metadata: malware_family Phemedrone, created_at 2023_04_27, former_category MALWARE;
sid: 1; rev: 1;)  

```

Best regards, Jane.

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [August 7, 2023, 9:52pm UTC](https://community.emergingthreats.net/t/phemedrone-stealer/838/2 "2023-08-07T21:52:59Z")

</div>

Thanks @Jane0sint !  
` 2047068 - ET MALWARE [ANY.RUN] Phemedrone Stealer Exfiltration via Telegram`