Analysis
-
max time kernel
51s -
max time network
91s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20/05/2021, 05:40 UTC
General
-
Target
CS SkinCHANGER.exe
-
Size
1016KB
-
MD5
4baf19886d71c6d9312b3a71dcfea37e
-
SHA1
ebacfba77117ec07d108f1b80e419be9674a48da
-
SHA256
1d2005df287958967e785ebc022f183ed7b3878b631d75d61ed8d94bcda0ee58
-
SHA512
0bb4d418ca83f1f85edcfbea1cf3704d42ebb9e3092c70f0a982238210adc9b51cfa47f19df67f7f2714444f04ac4bbf27887724f1dbcd6d1ba84c872074067c
Score
10/10
Malware Config
Signatures
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CS SkinCHANGER.exe"C:\Users\Admin\AppData\Local\Temp\CS SkinCHANGER.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CS SkinCHANGER.exe"C:\Users\Admin\AppData\Local\Temp\CS SkinCHANGER.exe"2⤵
-
Network
-
DNScollector-node.usRemote address:8.8.8.8:53Requestcollector-node.usIN A -
DNScollector-node.usRemote address:8.8.8.8:53Requestcollector-node.usIN A
-
DNScollector-node.usRemote address:8.8.8.8:53Requestcollector-node.usIN A
-
DNScollector-node.usRemote address:8.8.8.8:53Requestcollector-node.usIN A
-
DNScollector-node.usRemote address:8.8.8.8:53Requestcollector-node.usIN A
-
DNScollector-steal.gaRemote address:8.8.8.8:53Requestcollector-steal.gaIN A
-
DNScollector-steal.gaRemote address:8.8.8.8:53Requestcollector-steal.gaIN A
-
DNScollector-steal.gaRemote address:8.8.8.8:53Requestcollector-steal.gaIN A
-
DNScollector-steal.gaRemote address:8.8.8.8:53Requestcollector-steal.gaIN A
-
DNScollector-steal.gaRemote address:8.8.8.8:53Requestcollector-steal.gaIN A
No results found
-
8.8.8.8:53collector-node.usdns
DNS Request
collector-node.us
DNS Request
collector-node.us
DNS Request
collector-node.us
DNS Request
collector-node.us
DNS Request
collector-node.us
-
8.8.8.8:53collector-steal.gadns
DNS Request
collector-steal.ga
DNS Request
collector-steal.ga
DNS Request
collector-steal.ga
DNS Request
collector-steal.ga
DNS Request
collector-steal.ga
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
8KB