Overview

overview

10

Static

static

3

49ae90c147...b8.exe

windows7-x64

10

49ae90c147...b8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49ae90c1479fa19fcface2ef9c1c6bb8

  • Size

    1.8MB

  • Sample

    240107-y7py1aegh7

  • MD5

    49ae90c1479fa19fcface2ef9c1c6bb8

  • SHA1

    5ea3e5e103a4875d43d3fa694f182e5aa48526a6

  • SHA256

    acaa96229403e39ba1665e34d0e876685d8ee5fb6c006add9b4f6c0b709cba6e

  • SHA512

    193efa34aa6b2f38c73d6a2cb0544233d3dc354de10e10369c9754e07d78fdf3c5c1660d02e009981f85b6d0a4d364c5a8a6027a9e01f2ff75cc96a9d4efc5a2

  • SSDEEP

    49152:EH9WHhlw9pyJBxSZcNhaLVVo8xMWgXQH+:EsBlw9pqhaxVo8XMS+

Score
10/10
pandastealerspywarestealer

Malware Config

Extracted

Family

pandastealer

Version

1.11

C2

http://spacesecurity.fun

Targets

    • Target

      49ae90c1479fa19fcface2ef9c1c6bb8

    • Size

      1.8MB

    • MD5

      49ae90c1479fa19fcface2ef9c1c6bb8

    • SHA1

      5ea3e5e103a4875d43d3fa694f182e5aa48526a6

    • SHA256

      acaa96229403e39ba1665e34d0e876685d8ee5fb6c006add9b4f6c0b709cba6e

    • SHA512

      193efa34aa6b2f38c73d6a2cb0544233d3dc354de10e10369c9754e07d78fdf3c5c1660d02e009981f85b6d0a4d364c5a8a6027a9e01f2ff75cc96a9d4efc5a2

    • SSDEEP

      49152:EH9WHhlw9pyJBxSZcNhaLVVo8xMWgXQH+:EsBlw9pqhaxVo8XMS+

    Score
    10/10
    pandastealerstealerspyware

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

      stealerpandastealer

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks