Overview

overview

10

Static

static

7

8f97e558ee...13.exe

windows7-x64

10

8f97e558ee...13.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f97e558eec7e93afb68db5f8aa49713

  • Size

    5.7MB

  • Sample

    240204-tn54nadhf5

  • MD5

    8f97e558eec7e93afb68db5f8aa49713

  • SHA1

    96b72d8f0f07fc640a0d7c22277450177950e4c4

  • SHA256

    4356e334b5e726215e488ce5864601daf0ed5f84cd7fbb65943fb1625731e8b2

  • SHA512

    08ec3ee975a2284e1f5f6ffe65b7d47acf483148d936146545cc32b7516822d68a0f0a854bb9858e9145ecfbc3509b7901c3f0aaa526fbfe23d6e37ce19fe6be

  • SSDEEP

    98304:fDSCjP7797PBa5G3WBv2K9HoUTpcuUWdLpQXfisZkgWWuCNrzBhR/NHRfkC/Pc7h:9jz797Z32+2HT+EpQX6jIhzB5RfTHqX+

Score
10/10
pandastealerspywarestealervmprotect

Malware Config

Extracted

Family

pandastealer

Version

1.11

C2

http://f0566310.xsph.ru

Targets

    • Target

      8f97e558eec7e93afb68db5f8aa49713

    • Size

      5.7MB

    • MD5

      8f97e558eec7e93afb68db5f8aa49713

    • SHA1

      96b72d8f0f07fc640a0d7c22277450177950e4c4

    • SHA256

      4356e334b5e726215e488ce5864601daf0ed5f84cd7fbb65943fb1625731e8b2

    • SHA512

      08ec3ee975a2284e1f5f6ffe65b7d47acf483148d936146545cc32b7516822d68a0f0a854bb9858e9145ecfbc3509b7901c3f0aaa526fbfe23d6e37ce19fe6be

    • SSDEEP

      98304:fDSCjP7797PBa5G3WBv2K9HoUTpcuUWdLpQXfisZkgWWuCNrzBhR/NHRfkC/Pc7h:9jz797Z32+2HT+EpQX6jIhzB5RfTHqX+

    Score
    10/10
    pandastealerspywarestealervmprotect

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

      stealerpandastealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks