Extracted

• • Target

    aad5ab9e3e7b496ee42dabfcc4eb701f

  • Size

    2.9MB

  • MD5

    aad5ab9e3e7b496ee42dabfcc4eb701f

  • SHA1

    aa855ac0b9c494a755205595b2e6a5a25dd0d8ac

  • SHA256

    f08bc9686df2bad20a6c720608654fb4d3bb340a6b29d627af2ff06b476062c1

  • SHA512

    fb5a9429da1e61a8b2a72d39185e11e90b6590b2683209e28da1a845205e0bb73a7545abe653a33b730407546c8c841eaeff8285e1c3aa4255ec132facb464c8

  • SSDEEP

    49152:USmKvpcPKKp1Qk39FzhkiNuV9HXGsnInmAenNm5oThIwwwS7TSD3gjaem8H4vAzm:pmKvmPKKjQi/Nk+ur2snInKnNm5NwuTE

  Score

  10^/10

  pandastealerevasionspywarestealerthemidatrojan

  • Panda Stealer payload

  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2