Overview

overview

10

Static

static

7

8b3365e1fe...c7.exe

windows7-x64

10

8b3365e1fe...c7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b3365e1fe3a0b940f1fbd075a3c0cc7

  • Size

    5.1MB

  • Sample

    231226-yxnyysbcaj

  • MD5

    8b3365e1fe3a0b940f1fbd075a3c0cc7

  • SHA1

    7d3659c80dd811d564aa86e3d14d0cae27b4c84d

  • SHA256

    78d000e956e517b7ac492a482162b1967e80efa72a8a77023dae832c0cd3a554

  • SHA512

    01ea3dc7e4e43c6fbb64184610d1bcb733b8db56da2189bc2712e5a3e7bfdc873b950f1b0145069063981038126bafad6babd365cc3611af164d40f3600f0bc8

  • SSDEEP

    98304:FN8fdIXOm6fJIVpTR0Q/tMcYqV646hEab1x+JCod1E35TxIvRM:D8qyIVdRCcYqV6/Bx+4NJVIu

Score
10/10
pandastealerspywarestealervmprotect

Malware Config

Extracted

Family

pandastealer

Version

1.11

C2

http://f0565284.xsph.ru

Targets

    • Target

      8b3365e1fe3a0b940f1fbd075a3c0cc7

    • Size

      5.1MB

    • MD5

      8b3365e1fe3a0b940f1fbd075a3c0cc7

    • SHA1

      7d3659c80dd811d564aa86e3d14d0cae27b4c84d

    • SHA256

      78d000e956e517b7ac492a482162b1967e80efa72a8a77023dae832c0cd3a554

    • SHA512

      01ea3dc7e4e43c6fbb64184610d1bcb733b8db56da2189bc2712e5a3e7bfdc873b950f1b0145069063981038126bafad6babd365cc3611af164d40f3600f0bc8

    • SSDEEP

      98304:FN8fdIXOm6fJIVpTR0Q/tMcYqV646hEab1x+JCod1E35TxIvRM:D8qyIVdRCcYqV6/Bx+4NJVIu

    Score
    10/10
    pandastealerspywarestealervmprotect

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

      stealerpandastealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks