Extracted

• • Target

    30b02e598cbe1894d3c40a86dfdc5e68

  • Size

    2.9MB

  • MD5

    30b02e598cbe1894d3c40a86dfdc5e68

  • SHA1

    1193e7e46c1930330679717589d074b3317ac587

  • SHA256

    1f94bf7cb3397c4f28553728271df220d9d75c3e7d03c6f38a7aa5b79c054cd1

  • SHA512

    1cfb99240657563adf0801e79f3fd1a88063a28f94782502a4b8ac8fe5019f7ed99413dcc915dceaeea391b3fb8105498a767aff3b394a8ebbefe87180ede7ac

  • SSDEEP

    49152:NO38h57b5LGKwboJ3IvVYPHBdNGG6G551TsrFXPtYUJUYFU9y/7VPcJYTsptDHT2:Ca5FGZcWYPHBdcG6GD1TsRx4U75e2stu

  Score

  10^/10

  pandastealerevasionspywarestealerthemidatrojan

  • Panda Stealer payload

  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2