pandastealer | 2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7

General

Target

2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
Size

1.7MB
MD5

e14581bb18a5781d20545143ecb9ee23
SHA1

1dfaeab9ce8eeecef4aedf43cd1a85fa9e044fd8
SHA256

2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7
SHA512

6bf5bfaea695166e82412120a9771d5b66e518ed9b9495a3f3a54ce268ac7876dc8b67e1592d1813aa5add17cc52015c214dd320483e6a6a5282d1402464bc6a

Score

10^/10

Panda Stealer Payload 4 IoCs

resource	yara_rule
behavioral1/memory/776-65-0x0000000000400000-0x00000000004AD000-memory.dmp	family_pandastealer
behavioral1/memory/776-67-0x0000000000400000-0x00000000004AD000-memory.dmp	family_pandastealer
behavioral1/memory/776-69-0x0000000000400000-0x00000000004AD000-memory.dmp	family_pandastealer
behavioral1/memory/776-71-0x0000000000400000-0x00000000004AD000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 776	960	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	776	WerFault.exe	29

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 776	960	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	29
PID 960 wrote to memory of 776	960	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	29
PID 960 wrote to memory of 776	960	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	29
PID 960 wrote to memory of 776	960	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	29
PID 960 wrote to memory of 776	960	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	29
PID 960 wrote to memory of 776	960	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	29
PID 960 wrote to memory of 776	960	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	29
PID 960 wrote to memory of 776	960	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	29
PID 960 wrote to memory of 776	960	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	29
PID 960 wrote to memory of 776	960	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	29
PID 776 wrote to memory of 1352	776	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	30
PID 776 wrote to memory of 1352	776	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	30
PID 776 wrote to memory of 1352	776	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	30
PID 776 wrote to memory of 1352	776	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	30

memory/776-59-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/776-61-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/776-63-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/776-65-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/776-67-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/776-69-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/776-71-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/960-54-0x0000000001010000-0x00000000011C8000-memory.dmp

Filesize
1.7MB

Download
memory/960-55-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/960-56-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/960-57-0x00000000003D0000-0x00000000003E4000-memory.dmp

Filesize
80KB

Download
memory/960-58-0x00000000085B0000-0x00000000086D4000-memory.dmp

Filesize
1.1MB

Download