pandastealer | 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af

General

Target

12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe
Size

1.1MB
MD5

51742a4508425c35b73662e12f6c1cb5
SHA1

d65b66a7c59f070dc1a35b563b753f4eddfdd431
SHA256

12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af
SHA512

1330f7e246eeb600bf60d972cd05c9a3f0a0558955d75958cff6f62b86c43c8a9386eed1fc5433c290f0c1db4b853d0403bd56f2451444f0a8e6311f6b6ba052

Score

10^/10

Panda Stealer Payload 4 IoCs

resource	yara_rule
behavioral1/memory/472-62-0x0000000000400000-0x0000000000497000-memory.dmp	family_pandastealer
behavioral1/memory/472-63-0x0000000000400000-0x0000000000497000-memory.dmp	family_pandastealer
behavioral1/memory/472-64-0x0000000000400000-0x0000000000497000-memory.dmp	family_pandastealer
behavioral1/memory/472-65-0x0000000000400000-0x0000000000497000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1680 set thread context of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27
PID 1680 wrote to memory of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27
PID 1680 wrote to memory of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27
PID 1680 wrote to memory of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27
PID 1680 wrote to memory of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27
PID 1680 wrote to memory of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27
PID 1680 wrote to memory of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27
PID 1680 wrote to memory of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27
PID 1680 wrote to memory of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27
PID 1680 wrote to memory of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27
PID 1680 wrote to memory of 472	1680	12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe	27

C:\Users\Admin\AppData\Local\Temp\12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe
"C:\Users\Admin\AppData\Local\Temp\12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe
  "C:\Users\Admin\AppData\Local\Temp\12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe"
  2⤵
  PID:472

memory/472-59-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/472-60-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/472-61-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/472-62-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/472-63-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/472-64-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/472-65-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/1680-54-0x0000000000B10000-0x0000000000C22000-memory.dmp

Filesize
1.1MB

Download
memory/1680-55-0x00000000744FE000-0x00000000744FF000-memory.dmp

Filesize
4KB

Download
memory/1680-56-0x0000000004C00000-0x0000000004CEE000-memory.dmp

Filesize
952KB

Download
memory/1680-57-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/1680-58-0x0000000000A40000-0x0000000000A5C000-memory.dmp

Filesize
112KB

Download