General

  • Target

    ee7c97b8f6d16ec0ba83e60e99f625be58bbcf24c0ddeba40461324661732170

  • Size

    657KB

  • Sample

    220206-jkmg2agfhn

  • MD5

    8ed6d907728a4b6647b1283abbfc2233

  • SHA1

    34965adb74613e90a0b0777098fd39c97ff6f877

  • SHA256

    ee7c97b8f6d16ec0ba83e60e99f625be58bbcf24c0ddeba40461324661732170

  • SHA512

    6da65cb2956f23efb19b4082fa768b9affc4a4e3f1c36532b471e47d5bf392f7976bac9c04b22bec7992d614785a347e0e9592e104fdb0503491fb61afaf3e1a

Malware Config

Targets

    • Target

      ee7c97b8f6d16ec0ba83e60e99f625be58bbcf24c0ddeba40461324661732170

    • Size

      657KB

    • MD5

      8ed6d907728a4b6647b1283abbfc2233

    • SHA1

      34965adb74613e90a0b0777098fd39c97ff6f877

    • SHA256

      ee7c97b8f6d16ec0ba83e60e99f625be58bbcf24c0ddeba40461324661732170

    • SHA512

      6da65cb2956f23efb19b4082fa768b9affc4a4e3f1c36532b471e47d5bf392f7976bac9c04b22bec7992d614785a347e0e9592e104fdb0503491fb61afaf3e1a

    • Panda Stealer Payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks