pandastealer | 210624-qbwcpjfqhx_pw_infected[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
210624-qbwcpjfqhx_pw_infected.zip
Size 416KB
Sample240221-tek25aba88
SHA256 5dcdcee4ad221f5a09120fb60440afc54c3d6a2e62c9bd3ff76cf577e7031711
MD5 0b09f0860395935fb8d78653c70722a8
SHA1 8a573e49063058c44daa77119d9b61e3a6105d35
SHA512 138eef315068119398c5cf41c66dd85cc92f7a1983b9df7729d4d3ccc4d6f11d6053fa97a5018cf1b876cc6528553c48c9eabf7132b77ccdd2e6fdc40b9fa80a
SSDEEP 12288:T/n9GGshsPSYIVqdU4ZK8goFCJpIiFv+RZYr85:Dnh4QSYI6Ur8goFCJyler85
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pandastealer

Malware Config

Signatures

Panda Stealer payload 1 IoCs

resource	yara_rule
static1/unpack001/ForceNitro.exe	family_pandastealer

Pandastealer family
pandastealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ForceNitro.exe

File Explorer

210624-qbwcpjfqhx_pw_infected.zip

.zip .ps1 416KB
ForceNitro.exe

.exe 762KB

210624-qbwcpjfqhx_pw_infected.zip

SHA256 5dcdcee4ad221f5a09120fb60440afc54c3d6a2e62c9bd3ff76cf577e7031711
MD5 0b09f0860395935fb8d78653c70722a8
SHA1 8a573e49063058c44daa77119d9b61e3a6105d35
SHA512 138eef315068119398c5cf41c66dd85cc92f7a1983b9df7729d4d3ccc4d6f11d6053fa97a5018cf1b876cc6528553c48c9eabf7132b77ccdd2e6fdc40b9fa80a
SSDEEP 12288:T/n9GGshsPSYIVqdU4ZK8goFCJpIiFv+RZYr85:Dnh4QSYI6Ur8goFCJyler85
MD5 SHA1 SHA512 SSDEEP

polyglot

Password

infected

ForceNitro.exe

IMPHASH 51ff75d6d097884e3e24394f5a7d0c8f
SHA256 70b80a1a24d526e456893f0185550c15c3d914deaf8ebaa02d8817a15aa5bf80
MD5 6abff90b8cb80533bca9eb040ed698da
SHA1 ae2e389320bec602965a5f12c13e595df870ac0f
SHA512 086e4c1eb5a32ae116ffeaf28995cf4e660460fec758c1c4708d0df30413b774924e863381b6a46125c09a82570fbde933f24cac8a0691751998eb075fff1813
SSDEEP 12288:RXfl4WqP5C+ZQpvBlUh1ArlVOs/mRtZJhg6VQ/IoDsp+LbMoUA5bQcoln+TMuHat:RXN4WO5upvH4ip/mRtZJVQ/IoDswYg0B
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Panda Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454039

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnterCriticalSection GetCurrentProcess WriteFile LeaveCriticalSection SetFilePointer InitializeCriticalSectionEx UnmapViewOfFile GetModuleHandleA HeapSize MultiByteToWideChar GetFileInformationByHandle CopyFileA GetLastError CreateFileA FileTimeToSystemTime LoadLibraryA LockResource HeapReAlloc CloseHandle RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc GetLocalTime DecodePointer HeapDestroy GetProcAddress CreateFileMappingA GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte HeapFree MapViewOfFile GetTickCount IsWow64Process AreFileApisANSI GetFullPathNameW LockFile InitializeCriticalSection GetFullPathNameA SetEndOfFile GetTempPathW CreateFileW GetFileAttributesW GetCurrentThreadId Sleep GetTempPathA GetFileAttributesA GetVersionExA DeleteFileA DeleteFileW LoadLibraryW UnlockFile LockFileEx GetCurrentProcessId GetSystemTimeAsFileTime GetSystemTime FormatMessageA QueryPerformanceCounter FlushFileBuffers SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SizeofResource GetModuleFileNameA CreateProcessA ReadFile ReadConsoleW GetTimeZoneInformation GetFileSizeEx GetConsoleMode GetConsoleCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW WriteConsoleW GetDateFormatW GetCommandLineW GetCommandLineA GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess QueryPerformanceFrequency VirtualQuery VirtualProtect VirtualAlloc GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW RemoveDirectoryW SetFilePointerEx SetLastError GetModuleHandleW CopyFileW LocalFree GetStringTypeW EncodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead TerminateProcess RtlUnwind LoadLibraryExW GetSystemInfo

user32

GetDC GetSystemMetrics ReleaseDC GetDesktopWindow

gdi32

DeleteObject GetObjectA

shlwapi

PathFindExtensionW PathFindExtensionA

gdiplus

GdipSaveImageToFile GdipCreateBitmapFromScan0 GdipGetImageEncodersSize GdipDisposeImage GdipGetImageEncoders GdiplusStartup GdipCreateBitmapFromHBITMAP GdiplusShutdown

wininet

HttpEndRequestA HttpSendRequestExA InternetOpenA InternetCloseHandle HttpOpenRequestA HttpSendRequestA InternetConnectA InternetReadFile