Extracted

Extracted

• • Target

    abdd8d2b92994b87215496904e6f7b352de5391eab24275a394c6eb018d29273

  • Size

    24.8MB

  • MD5

    2a7a396903e48cf898f8e9c6c77a875d

  • SHA1

    6547cbb2947e005c9ea42539107b98db8b9c77d7

  • SHA256

    abdd8d2b92994b87215496904e6f7b352de5391eab24275a394c6eb018d29273

  • SHA512

    63689d85ae71a1a703d58b16b5c45891c8048e1eb63252b105eee640b5923f7ac882ab767f7cc3089e0b919d7e6a826d5c6220fb1d7dee4ea284e2f172b1e189

  • SSDEEP

    393216:F8QZskDN3u5yyHTV7JDL9a+43tFuUiuJzuFfTy1J4uz4SfPIY:F8QZsudeDL9n43X9iuNWTS9X3

  Score

  10^/10

  pandastealerdiscoveryevasionexploitspywarestealer

  • Modifies security service

    evasion

  • Panda Stealer payload

  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Possible privilege escalation attempt

    exploit

  • Stops running service(s)

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2