Overview

overview

10

Static

static

7

30b02e598c...68.exe

windows7-x64

10

30b02e598c...68.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30b02e598cbe1894d3c40a86dfdc5e68

  • Size

    2.9MB

  • Sample

    231231-lb4fascca9

  • MD5

    30b02e598cbe1894d3c40a86dfdc5e68

  • SHA1

    1193e7e46c1930330679717589d074b3317ac587

  • SHA256

    1f94bf7cb3397c4f28553728271df220d9d75c3e7d03c6f38a7aa5b79c054cd1

  • SHA512

    1cfb99240657563adf0801e79f3fd1a88063a28f94782502a4b8ac8fe5019f7ed99413dcc915dceaeea391b3fb8105498a767aff3b394a8ebbefe87180ede7ac

  • SSDEEP

    49152:NO38h57b5LGKwboJ3IvVYPHBdNGG6G551TsrFXPtYUJUYFU9y/7VPcJYTsptDHT2:Ca5FGZcWYPHBdcG6GD1TsRx4U75e2stu

Score
10/10
pandastealerevasionspywarestealerthemidatrojan

Malware Config

Extracted

Family

pandastealer

Version

1.11

C2

http://f0562538.xsph.ru

Targets

    • Target

      30b02e598cbe1894d3c40a86dfdc5e68

    • Size

      2.9MB

    • MD5

      30b02e598cbe1894d3c40a86dfdc5e68

    • SHA1

      1193e7e46c1930330679717589d074b3317ac587

    • SHA256

      1f94bf7cb3397c4f28553728271df220d9d75c3e7d03c6f38a7aa5b79c054cd1

    • SHA512

      1cfb99240657563adf0801e79f3fd1a88063a28f94782502a4b8ac8fe5019f7ed99413dcc915dceaeea391b3fb8105498a767aff3b394a8ebbefe87180ede7ac

    • SSDEEP

      49152:NO38h57b5LGKwboJ3IvVYPHBdNGG6G551TsrFXPtYUJUYFU9y/7VPcJYTsptDHT2:Ca5FGZcWYPHBdcG6GD1TsRx4U75e2stu

    Score
    10/10
    pandastealerevasionspywarestealerthemidatrojan

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

      stealerpandastealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks