pandastealer | a99146b239d8f7be6e7281460eb625ef

Sharing

Copy URL Twitter E-mail

General

Target
a99146b239d8f7be6e7281460eb625ef
Size 472KB
Sample231227-jqv2csdeej
SHA256 702dc8fde667d79575a192cee0075d75b6c2266138896e529cdc08fdaaea440c
MD5 a99146b239d8f7be6e7281460eb625ef
SHA1 7ac0e23d8c1e6ade2d7eedf2bdcbf431967aa726
SHA512 255a6ee52c7e31bc9ce90d1d483763683461f7af55fa44d4049c420dc1ab95e753fe712abfe649fb199385ee82c7c2135ced5a0a8873a84ff8935403678584bd
SSDEEP 12288:769T4U4+vKZhrTko73ri3CXEiFqrVVSPVpJDalpS6Xq2EVvfdm:7WTkqKfrTko77i3CXEigVVSPwlpSy0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pandastealer shurk

Malware Config

Signatures

Panda Stealer payload 1 IoCs

resource	yara_rule
sample	family_pandastealer

Pandastealer family
pandastealer

Shurk Stealer payload 1 IoCs

resource	yara_rule
sample	shurk_stealer

Shurk family
shurk

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a99146b239d8f7be6e7281460eb625ef

File Explorer

a99146b239d8f7be6e7281460eb625ef

.exe 472KB

a99146b239d8f7be6e7281460eb625ef

IMPHASH f78ec1580e5cf11dc31a5258bb19ce5a
SHA256 702dc8fde667d79575a192cee0075d75b6c2266138896e529cdc08fdaaea440c
MD5 a99146b239d8f7be6e7281460eb625ef
SHA1 7ac0e23d8c1e6ade2d7eedf2bdcbf431967aa726
SHA512 255a6ee52c7e31bc9ce90d1d483763683461f7af55fa44d4049c420dc1ab95e753fe712abfe649fb199385ee82c7c2135ced5a0a8873a84ff8935403678584bd
SSDEEP 12288:769T4U4+vKZhrTko73ri3CXEiFqrVVSPVpJDalpS6Xq2EVvfdm:7WTkqKfrTko77i3CXEigVVSPwlpSy0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Panda Stealer payload
Shurk Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

287099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFilePointer GetFullPathNameA SetEndOfFile GetTempPathW CreateFileW GetFileAttributesW GetCurrentThreadId MultiByteToWideChar Sleep GetTempPathA GetLastError GetFileAttributesA CreateFileA LoadLibraryA GetVersionExA DeleteFileA DeleteFileW CloseHandle LoadLibraryW UnlockFile GetProcAddress LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers GetModuleFileNameA SetWaitableTimer TlsSetValue VerifyVersionInfoA HeapFree SetLastError VirtualAlloc InitializeCriticalSection InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus InitializeCriticalSectionEx WaitForSingleObject UnmapViewOfFile GetModuleHandleA OpenProcess HeapSize SetCurrentDirectoryA PostQueuedCompletionStatus CreateToolhelp32Snapshot CreateEventW GetFileInformationByHandle CopyFileA QueryFullProcessImageNameA SetEvent FileTimeToSystemTime TerminateThread TlsAlloc Process32Next HeapReAlloc RaiseException HeapAlloc QueueUserAPC GetLocalTime DecodePointer CreateFileMappingA LocalFree VerSetConditionMask GetProcessHeap SystemTimeToFileTime SleepEx TlsGetValue TlsFree MapViewOfFile CreateIoCompletionPort WriteConsoleW GetStringTypeW SetStdHandle SetEnvironmentVariableW LockFile LeaveCriticalSection WriteFile GetFullPathNameW EnterCriticalSection ReadFile WaitForMultipleObjects AreFileApisANSI VirtualQuery FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetTimeZoneInformation GetFileSizeEx GetConsoleMode GetConsoleOutputCP LCMapStringW CompareStringW GetFileType GetCPInfo GetCommandLineW GetCommandLineA ResetEvent WaitForSingleObjectEx GetModuleHandleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead GetCurrentProcess TerminateProcess GetCurrentDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle SetFilePointerEx GetFileInformationByHandleEx OutputDebugStringW RtlUnwind EncodePointer LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW GetStdHandle

user32

GetDesktopWindow

advapi32

GetUserNameA RegGetValueA RegOpenKeyExA

crypt32

CryptUnprotectData

bcrypt

BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptSetProperty

ws2_32

select ntohl WSASetLastError WSAStringToAddressW WSASocketW WSASend connect getsockopt htonl htons closesocket setsockopt WSAGetLastError WSACleanup WSAStartup ioctlsocket