Extracted

Extracted

• • Target

    fb626420f5fe5910a943314e2ec9f6a7

  • Size

    2.9MB

  • MD5

    fb626420f5fe5910a943314e2ec9f6a7

  • SHA1

    499305c3ac90d160ce9a42f31236fbe3c966892d

  • SHA256

    fb0ccb6e367ebaa52874292e05adae9cacafb2b42a8526bf1cb6028e753b9b7d

  • SHA512

    96aa1f3e0b151baf1d3adbe109db36b32907ba54859fa6dfd96bca2a1b88db12cff367eb0f8860af0fc39d2ac0c3a8d4ce0d3523edb40fb84f25eda45a4541e6

  • SSDEEP

    49152:5f5PFdGyL17PWkY3wfN8LBO881oUkii9Ps4c2vCSK3o1zRaXV+Wp9CjMIJH+eRui:5kuzWkNN8LBOrjY0QKUk7yVkeRL

  Score

  10^/10

  pandastealerevasionspywarestealerthemidatrojan

  • Panda Stealer payload

  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2