Overview

overview

10

Static

static

7

84bbbbaebc...18.exe

windows7-x64

10

84bbbbaebc...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    84bbbbaebc8225dc417b2e7317151d91_JaffaCakes118

  • Size

    5.7MB

  • Sample

    240402-f1fgwahe6y

  • MD5

    84bbbbaebc8225dc417b2e7317151d91

  • SHA1

    0661a14b27d39e1a18c61d70e511ee7e0b66c7e9

  • SHA256

    dc4750b004e7bd48044a2fc372c56fad5ff092bff920b01b03cd8f1d53618b98

  • SHA512

    9767c02fda4a4a4fab3b0c53d50257185f75b043fcada2dc1d284bb33f684717c36ab15f62a40ff63b7744bd5d355a743be7ed801a067d23f05135a5a323f5cd

  • SSDEEP

    98304:et9EvIKtm84albtbB1sNggNDAH1kgM96pP7qgVlfD1hNlO3QMz+TlA1HWRpP:AuIKtm89bFCD4A96ZukNHyp+TlA1H4

Score
10/10
pandastealerspywarestealervmprotect

Malware Config

Extracted

Family

pandastealer

Version

1.11

C2

http://cakezer.com.xsph.ru

Targets

    • Target

      84bbbbaebc8225dc417b2e7317151d91_JaffaCakes118

    • Size

      5.7MB

    • MD5

      84bbbbaebc8225dc417b2e7317151d91

    • SHA1

      0661a14b27d39e1a18c61d70e511ee7e0b66c7e9

    • SHA256

      dc4750b004e7bd48044a2fc372c56fad5ff092bff920b01b03cd8f1d53618b98

    • SHA512

      9767c02fda4a4a4fab3b0c53d50257185f75b043fcada2dc1d284bb33f684717c36ab15f62a40ff63b7744bd5d355a743be7ed801a067d23f05135a5a323f5cd

    • SSDEEP

      98304:et9EvIKtm84albtbB1sNggNDAH1kgM96pP7qgVlfD1hNlO3QMz+TlA1HWRpP:AuIKtm89bFCD4A96ZukNHyp+TlA1H4

    Score
    10/10
    pandastealerspywarestealervmprotect

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

      stealerpandastealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks