pandastealer | 431fd6d04bb3e1c1dfb5ffc096246c3321fd467a110433640823f9ea5c90751d

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

740554cb974f32f7542251b70cbafb6a.exe
Size

681KB
MD5

740554cb974f32f7542251b70cbafb6a
SHA1

15b5556c763412afbd882a2876fb85bad7a4d55c
SHA256

431fd6d04bb3e1c1dfb5ffc096246c3321fd467a110433640823f9ea5c90751d
SHA512

3eb17f1158023a7478c7a526c17a90f0bd34ff60d31e87d9c19cde7225b8549d4665eb9c8e2f992b29aa4803c646fb19d04fe54204e116463cf8d5ef8f3efc76
SSDEEP

12288:VoJqNIPtNmO6IOOEp0TMlja7NRl2PSVikIyoyueh+AkHcnLwuukoCOD6zlWjOz+2:VoJEKZ6IEGTMxapRl2PSwHTehy6BN+p4

Score

10^/10

pandastealer spyware stealer

Malware Config

Signatures

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

740554cb974f32f7542251b70cbafb6a.exe

pid process

1492 740554cb974f32f7542251b70cbafb6a.exe

pid	process
1492	740554cb974f32f7542251b70cbafb6a.exe

C:\Users\Admin\AppData\Local\Temp\740554cb974f32f7542251b70cbafb6a.exe
"C:\Users\Admin\AppData\Local\Temp\740554cb974f32f7542251b70cbafb6a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download