pandastealer | ebff40457d5e51cfe5b3cbe132131ec6a7f44daeac67ead885e1498bf2275979

Analysis

Target

57061804ee3f62601d4147b0e0953ab4.exe
Size

681KB
MD5

57061804ee3f62601d4147b0e0953ab4
SHA1

d3ca90ea276a8fffe5e46b6c79f4193d7c84d9cc
SHA256

ebff40457d5e51cfe5b3cbe132131ec6a7f44daeac67ead885e1498bf2275979
SHA512

30af8c0f18235340c4c571cb06238c52b332d293d1151e6913bf9c426b2a9fa72dbba89bcc6c20099946fe2fb15f1722d00c2229fbf2ea42f7a0c70da69e5662

Score

10^/10

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1844	57061804ee3f62601d4147b0e0953ab4.exe

C:\Users\Admin\AppData\Local\Temp\57061804ee3f62601d4147b0e0953ab4.exe
"C:\Users\Admin\AppData\Local\Temp\57061804ee3f62601d4147b0e0953ab4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1844

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1844-60-0x0000000076A81000-0x0000000076A83000-memory.dmp

Filesize
8KB

Download