General

  • Target

    210624-qbwcpjfqhx_pw_infected.zip

  • Size

    416KB

  • Sample

    240221-tek25aba88

  • MD5

    0b09f0860395935fb8d78653c70722a8

  • SHA1

    8a573e49063058c44daa77119d9b61e3a6105d35

  • SHA256

    5dcdcee4ad221f5a09120fb60440afc54c3d6a2e62c9bd3ff76cf577e7031711

  • SHA512

    138eef315068119398c5cf41c66dd85cc92f7a1983b9df7729d4d3ccc4d6f11d6053fa97a5018cf1b876cc6528553c48c9eabf7132b77ccdd2e6fdc40b9fa80a

  • SSDEEP

    12288:T/n9GGshsPSYIVqdU4ZK8goFCJpIiFv+RZYr85:Dnh4QSYI6Ur8goFCJyler85

Malware Config

Targets

    • Target

      ForceNitro.exe

    • Size

      762KB

    • MD5

      6abff90b8cb80533bca9eb040ed698da

    • SHA1

      ae2e389320bec602965a5f12c13e595df870ac0f

    • SHA256

      70b80a1a24d526e456893f0185550c15c3d914deaf8ebaa02d8817a15aa5bf80

    • SHA512

      086e4c1eb5a32ae116ffeaf28995cf4e660460fec758c1c4708d0df30413b774924e863381b6a46125c09a82570fbde933f24cac8a0691751998eb075fff1813

    • SSDEEP

      12288:RXfl4WqP5C+ZQpvBlUh1ArlVOs/mRtZJhg6VQ/IoDsp+LbMoUA5bQcoln+TMuHat:RXN4WO5upvH4ip/mRtZJVQ/IoDswYg0B

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks