pandastealer | d78f6e614c824121dfca6db7d69f2319

Sharing

Copy URL Twitter E-mail

General

Target
d78f6e614c824121dfca6db7d69f2319
Size 472KB
Sample240320-bqf87sdb84
SHA256 8a548ac448370ff5c00b77e1f4592c9c0934087f729ee57f547e34e03792f2c1
MD5 d78f6e614c824121dfca6db7d69f2319
SHA1 084951271b3ab0292a9719a56463b7ff58db95ae
SHA512 d7e58dac654e719f27133c0a097f88da90b4de12b65167af9b44605a81c77100fadfed30a7ab6eed019d995570649cd5e0d442093e2cdb615bc8ab9f0b10e17b
SSDEEP 12288:769T4U4+vKZhrTko73ri3CXEiFqrVVSP4pJDalpS6Xq2EVGfdm:7WTkqKfrTko77i3CXEigVVSPrlpSy/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pandastealer shurk

Malware Config

Signatures

Panda Stealer payload 1 IoCs

resource	yara_rule
sample	family_pandastealer

Pandastealer family
pandastealer

Shurk Stealer payload 1 IoCs

resource	yara_rule
sample	shurk_stealer

Shurk family
shurk

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d78f6e614c824121dfca6db7d69f2319

File Explorer

d78f6e614c824121dfca6db7d69f2319

.exe 472KB

d78f6e614c824121dfca6db7d69f2319

IMPHASH f78ec1580e5cf11dc31a5258bb19ce5a
SHA256 8a548ac448370ff5c00b77e1f4592c9c0934087f729ee57f547e34e03792f2c1
MD5 d78f6e614c824121dfca6db7d69f2319
SHA1 084951271b3ab0292a9719a56463b7ff58db95ae
SHA512 d7e58dac654e719f27133c0a097f88da90b4de12b65167af9b44605a81c77100fadfed30a7ab6eed019d995570649cd5e0d442093e2cdb615bc8ab9f0b10e17b
SSDEEP 12288:769T4U4+vKZhrTko73ri3CXEiFqrVVSP4pJDalpS6Xq2EVGfdm:7WTkqKfrTko77i3CXEigVVSPrlpSy/
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Panda Stealer payload
Shurk Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

287099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFilePointer GetFullPathNameA SetEndOfFile GetTempPathW CreateFileW GetFileAttributesW GetCurrentThreadId MultiByteToWideChar Sleep GetTempPathA GetLastError GetFileAttributesA CreateFileA LoadLibraryA GetVersionExA DeleteFileA DeleteFileW CloseHandle LoadLibraryW UnlockFile GetProcAddress LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers GetModuleFileNameA SetWaitableTimer TlsSetValue VerifyVersionInfoA HeapFree SetLastError VirtualAlloc InitializeCriticalSection InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus InitializeCriticalSectionEx WaitForSingleObject UnmapViewOfFile GetModuleHandleA OpenProcess HeapSize SetCurrentDirectoryA PostQueuedCompletionStatus CreateToolhelp32Snapshot CreateEventW GetFileInformationByHandle CopyFileA QueryFullProcessImageNameA SetEvent FileTimeToSystemTime TerminateThread TlsAlloc Process32Next HeapReAlloc RaiseException HeapAlloc QueueUserAPC GetLocalTime DecodePointer CreateFileMappingA LocalFree VerSetConditionMask GetProcessHeap SystemTimeToFileTime SleepEx TlsGetValue TlsFree MapViewOfFile CreateIoCompletionPort WriteConsoleW GetStringTypeW SetStdHandle SetEnvironmentVariableW LockFile LeaveCriticalSection WriteFile GetFullPathNameW EnterCriticalSection ReadFile WaitForMultipleObjects AreFileApisANSI VirtualQuery FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetTimeZoneInformation GetFileSizeEx GetConsoleMode GetConsoleOutputCP LCMapStringW CompareStringW GetFileType GetCPInfo GetCommandLineW GetCommandLineA ResetEvent WaitForSingleObjectEx GetModuleHandleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead GetCurrentProcess TerminateProcess GetCurrentDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle SetFilePointerEx GetFileInformationByHandleEx OutputDebugStringW RtlUnwind EncodePointer LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW GetStdHandle

user32

GetDesktopWindow

advapi32

GetUserNameA RegGetValueA RegOpenKeyExA

crypt32

CryptUnprotectData

bcrypt

BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptSetProperty

ws2_32

select ntohl WSASetLastError WSAStringToAddressW WSASocketW WSASend connect getsockopt htonl htons closesocket setsockopt WSAGetLastError WSACleanup WSAStartup ioctlsocket