pandastealer | d5246f6059a82cfc79436470752980e457f503cfa2f2dde70357735bd9c75de4 | Triage

Submit
Reports

Overview

overview

Static

static

7

e4b6f3db11...18.exe

windows7-x64

e4b6f3db11...18.exe

windows10-2004-x64

Sharing

General

Target

e4b6f3db1160cf6f89db609a12fb0a22_JaffaCakes118
Size

5.6MB
Sample

240916-nz82sswdkp
MD5

e4b6f3db1160cf6f89db609a12fb0a22
SHA1

457c55785a8fb0e88e4b50cdf0b20cf2a3806652
SHA256

d5246f6059a82cfc79436470752980e457f503cfa2f2dde70357735bd9c75de4
SHA512

91eb0a352cbf28fca1d15ae8d9b59971a704cb4da874a1af1427509c2125e389cd0328787dd48de2609fb55e4b6b6a0a01f0d6ff0f203343c071ee0fd3cc6f06
SSDEEP

98304:3vgcTTnJvpjXlIFpmfP81G+lBMnRPPgQ8lFgxmOja1gyHzfhnQuJFxjxpH3:3vrTdvJXTfP2G+lBmPIQeHKWgyTRQapZ

Score

10^/10

pandastealer discovery stealer vmprotect

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

e4b6f3db1160cf6f89db609a12fb0a22_JaffaCakes118.exe

Resource

win7-20240903-en

pandastealer stealer vmprotect

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

e4b6f3db1160cf6f89db609a12fb0a22_JaffaCakes118.exe

Resource

win10v2004-20240802-en

pandastealer discovery stealer vmprotect

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  e4b6f3db1160cf6f89db609a12fb0a22_JaffaCakes118
- Size
  
  5.6MB
- MD5
  
  e4b6f3db1160cf6f89db609a12fb0a22
- SHA1
  
  457c55785a8fb0e88e4b50cdf0b20cf2a3806652
- SHA256
  
  d5246f6059a82cfc79436470752980e457f503cfa2f2dde70357735bd9c75de4
- SHA512
  
  91eb0a352cbf28fca1d15ae8d9b59971a704cb4da874a1af1427509c2125e389cd0328787dd48de2609fb55e4b6b6a0a01f0d6ff0f203343c071ee0fd3cc6f06
- SSDEEP
  
  98304:3vgcTTnJvpjXlIFpmfP81G+lBMnRPPgQ8lFgxmOja1gyHzfhnQuJFxjxpH3:3vrTdvJXTfP2G+lBmPIQeHKWgyTRQapZ
Score

10^/10

pandastealer stealer vmprotect discovery
- Panda Stealer payload
- PandaStealer
  Panda Stealer is a fork of CollectorProject Stealer written in C++.
  stealer pandastealer
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

pandastealerstealervmprotect

behavioral2

pandastealerdiscoverystealervmprotect

© 2018-2024

Terms | Privacy