pandastealer | 2665361cf05b16f5e4a06e0854b242bf8af84443a9a58fdf20781a56a0be4aea | Triage

Submit
Reports

Overview

overview

Static

static

1

dridex

windows10-2004-x64

Sharing

General

Target

2665361cf05b16f5e4a06e0854b242bf8af84443a9a58fdf20781a56a0be4aea
Size

190KB
Sample

230215-weqnqadb52
MD5

0f4366fc1e39b87214e8a8a8cf306410
SHA1

0762fb2cda9320ccfefadc7ad269c4a65d24d8e5
SHA256

2665361cf05b16f5e4a06e0854b242bf8af84443a9a58fdf20781a56a0be4aea
SHA512

60e0c53acaa754458e29f35c492e728b4fdb464d9d522ea05acb07c69f728991ba7486019829417c0bef90fee3eb7f5b5686c5cd1a14f480a029287fc425e8d7
SSDEEP

3072:AmNzQBbee3rl9gEI3SF8xyiuVusp77d/lpBL3dHW8GW:AgzQ8e3roEIiFCvvg77Ld28

Score

10^/10

pandastealer smokeloader backdoor discovery spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

2665361cf05b16f5e4a06e0854b242bf8af84443a9a58fdf20781a56a0be4aea.exe

Resource

win10v2004-20220901-en

pandastealer smokeloader backdoor discovery spyware stealer trojan

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  2665361cf05b16f5e4a06e0854b242bf8af84443a9a58fdf20781a56a0be4aea
- Size
  
  190KB
- MD5
  
  0f4366fc1e39b87214e8a8a8cf306410
- SHA1
  
  0762fb2cda9320ccfefadc7ad269c4a65d24d8e5
- SHA256
  
  2665361cf05b16f5e4a06e0854b242bf8af84443a9a58fdf20781a56a0be4aea
- SHA512
  
  60e0c53acaa754458e29f35c492e728b4fdb464d9d522ea05acb07c69f728991ba7486019829417c0bef90fee3eb7f5b5686c5cd1a14f480a029287fc425e8d7
- SSDEEP
  
  3072:AmNzQBbee3rl9gEI3SF8xyiuVusp77d/lpBL3dHW8GW:AgzQ8e3roEIiFCvvg77Ld28
Score

10^/10

pandastealer smokeloader backdoor discovery spyware stealer trojan
- Detects Smokeloader packer
- Panda Stealer payload
- PandaStealer
  Panda Stealer is a fork of CollectorProject Stealer written in C++.
  stealer pandastealer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

pandastealersmokeloaderbackdoordiscoveryspywarestealertrojan

© 2018-2024

Terms | Privacy