pandastealer | 0d43acbb159687bdfda23da84ae785677f0a4c14010be48ead657d2b71a359bd

Sharing

Copy URL

Twitter E-mail

General

Target

229da05be0a100309faa895327f9ddad_JaffaCakes118
Size

5.0MB
Sample

241008-vcs6dsyhph
MD5

229da05be0a100309faa895327f9ddad
SHA1

e288f81cbaea3b1064e8e584ac752e8e0046d881
SHA256

0d43acbb159687bdfda23da84ae785677f0a4c14010be48ead657d2b71a359bd
SHA512

0fb5a0959f9028cc5fd7fff4d516b3057d01b00373a40f481277c8f6b3c495c054abc095c135bc330746123442c8305586a69d343f1ac1e6b4631e7314debcc6
SSDEEP

98304:NkFfHlOwTJ14TxU2DFSpR/TtrnxRDz/b262l2sFTLMicWkavgMNxwVsAIbPMqTe1:N4TJut8pR/BrjDHLpsLMifkaoMQ2desI

Score

10^/10

Malware Config

Targets

- Target
  
  229da05be0a100309faa895327f9ddad_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  229da05be0a100309faa895327f9ddad
- SHA1
  
  e288f81cbaea3b1064e8e584ac752e8e0046d881
- SHA256
  
  0d43acbb159687bdfda23da84ae785677f0a4c14010be48ead657d2b71a359bd
- SHA512
  
  0fb5a0959f9028cc5fd7fff4d516b3057d01b00373a40f481277c8f6b3c495c054abc095c135bc330746123442c8305586a69d343f1ac1e6b4631e7314debcc6
- SSDEEP
  
  98304:NkFfHlOwTJ14TxU2DFSpR/TtrnxRDz/b262l2sFTLMicWkavgMNxwVsAIbPMqTe1:N4TJut8pR/BrjDHLpsLMifkaoMQ2desI
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  !Զװ_Զ޸_.exe
- Size
  
  272KB
- MD5
  
  2420544863daa0241d80c7cfaeccfba8
- SHA1
  
  81de43c794934e182f3cf1a46eb2945335374877
- SHA256
  
  db490294180e2e1f0823ecb4c4ec7b9a0b2715dcc1c0ceddb6c7e629e2227dde
- SHA512
  
  53a8de13b8efda7cbfe65825aa2c50ba25acfc9dfb2699563dbeed7fa50aff640d3690294e2902ee4e409057b65e4de15a173fc21571ca951fab547e490b20ea
- SSDEEP
  
  6144:cwJzza5D2unOlV+CaNqZz09MXlmJV+5Y2kTQHlZz095wJzza5D2unOlV+CaN:cMzzgWlV8Nyzbl4V+5Y2kTQH7zWMzzg9
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/Blowfish.dll
- Size
  
  22KB
- MD5
  
  5afd4a9b7e69e7c6e312b2ce4040394a
- SHA1
  
  fbd07adb3f02f866dc3a327a86b0f319d4a94502
- SHA256
  
  053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
- SHA512
  
  f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
- SSDEEP
  
  384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/Locate.dll
- Size
  
  17KB
- MD5
  
  7d3317f57c1a368480ace3c0ca804eeb
- SHA1
  
  d4c7e185bc64aac82339f51ba6c21cf0713c9f1a
- SHA256
  
  d88a04c1e39db583eaad727fd390fe599ab10198ee040bfbdd22daefadbd2372
- SHA512
  
  5598c2e6caa2f66edd48f8c8305e054d4b0740b5f2b7ed92cf197a13ac66ba99a32013d34b3c2e28d007ab7979eb90a50681324eb736b1410e7df1902e4ec32a
- SSDEEP
  
  384:ev/vPBkA6dK8wiLe45naPji7hpx2kRV+qgm:evyvwiNnGji7Xxjc8
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/NSISdl.dll
- Size
  
  14KB
- MD5
  
  a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1
  
  168f3c158913b0367bf79fa413357fbe97018191
- SHA256
  
  dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- SHA512
  
  824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP
  
  192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/XML.dll
- Size
  
  118KB
- MD5
  
  42df1fbaa87567adf2b4050805a1a545
- SHA1
  
  b892a6efbb39b7144248e0c0d79e53da474a9373
- SHA256
  
  e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845
- SHA512
  
  4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d
- SSDEEP
  
  1536:U2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KC:OzjLkarn7O+n9z2L6whFtGF42bK
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  CrashReporter.exe
- Size
  
  314KB
- MD5
  
  db4add5c30802cdd977d9e923653d3bb
- SHA1
  
  6771d2ca40e6d5aba56417ab71775df8622d2083
- SHA256
  
  6f1604028553864bf50bd12307d19f46eaa28b7aa415a79027c3f52e50cbef53
- SHA512
  
  ee99ddfc48770f54d266c26850ccbd9a0976e5553d5f688264140ab42465b3787c20b80528131c9ee8b781c9ffe9462bc49c03cb030269502fc5e179a2778ec2
- SSDEEP
  
  6144:61wBQaH+d+BkqdOgjmOJfQIZEbFOGRxeh+jSjA+AZCjOMLpbbT7QrbN:6B+BksFp0bRxehwSnAZsOI7QfN
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  Incoming/MTV2012-°[ٷվ].url
- Size
  
  222B
- MD5
  
  7ea3100add5c6e434a5df4cfa6489fda
- SHA1
  
  75d915a8d2aea2eb7d25e2357432a609e2a1bf8c
- SHA256
  
  c2d98367d7bfd6467c38ec5d3986b0e69d57979046affa366c347101c618ce06
- SHA512
  
  710bd447839e41a25bbe9fb8179e6a4d7dd2ce0b563acd21b7baa4868c56d9f89e8ffaa6764d9c312abaaef3437a37e811f0da54f4ced97c26ba744244735eda
Score

1^/10
behavioral19 behavioral20
- Target
  
  Incoming/MTVؾ.MVȫ.MV.MV.url
- Size
  
  222B
- MD5
  
  46a22ce0dee5a969ad924894d81de06b
- SHA1
  
  858b81d4ed0007be083174dc9d9e9fc33a3a933a
- SHA256
  
  4cd195db0bb1fbe64f922325c9abe2b7f2a96fa826e117217d10466924a5d424
- SHA512
  
  880559a91606fc4ef6e94ffc8740b425df73162135020144aeb71139d04bb2fe7291ded167895008ddf750caa74eaefc2762ad11acb22080252cfa02d806e5df
Score

1^/10
behavioral21 behavioral22
- Target
  
  Incoming/Աר.֧Ƿ..url
- Size
  
  129B
- MD5
  
  971ab5831f326b1e1b9bd3fcb57a3e18
- SHA1
  
  2333202b5c2dca471c0a7cfb0216148f3e551447
- SHA256
  
  1ab91ab152140795cd422ec4cdd61fcb762b93e894ef368423b759fd8299d186
- SHA512
  
  cc3b2cebc17704a9293a2ed586f8d6de6340e4518d307dd4a36c8fc9837e9d8f7be6e8cb962a4c53a8f0073f75b000e9cdc5cc3dcc02239411af6ea6e45363c3
Score

1^/10
behavioral23 behavioral24
- Target
  
  MP2PLoader.exe
- Size
  
  65KB
- MD5
  
  84b293f20d8902ecd5987f964c4f3f81
- SHA1
  
  377d768081d84ad3c9b8f6a21fa6a54a0c9efc90
- SHA256
  
  97123ab632a0c339b6d629edee88d85afc3b89782f68c5d18a7409f266b68c4d
- SHA512
  
  a0318b41216b2a0a8b712ab3a307826d27752ceba3a006737dca011322196771d5c34adaf341813757664f5437986f2a9f081ffa73e0ef8a64cfc2f05b44b558
- SSDEEP
  
  1536:GYTUKKNc+y9nmvhjGLESJsQaN2Mf3QWmL:G7umvhKLQ3QWmL
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  
  MTVP2P_phone.tmpl
- Size
  
  68KB
- MD5
  
  7cb4d1a25f43e8cdf6c1a481404f3f11
- SHA1
  
  433eefff441abf432e2774894335d753cbb89205
- SHA256
  
  cec1b18212ce25622b4efc052ed94e0733f9d5437cdc5d7762994a901c56321d
- SHA512
  
  81438b938c40a61bbca539db1e747650104f4192f4e7fc4e5c31835c972ac39d0ad8b503c4c55ab04470e05e2274638a0c8ced4e41a90f9596b3d06b22bf66a1
- SSDEEP
  
  768:ghRMWI6lEQfXKMniYO0Fpqe/EUGlfn9mbq:gpfDimF8e/EUGlT
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  MediaInfo.dll
- Size
  
  2.7MB
- MD5
  
  c84bdf1a0f4ae35f07a8e7b92c6337f4
- SHA1
  
  082358db99b6ae5b08c774dbda2c9e5011e56485
- SHA256
  
  74a781072d145bdfa8f67542224b5cafa414aa8fc6a5225fa62e5995591a9792
- SHA512
  
  6e35b867df1a3df4a9f7e74d1969d55d2f8ffa84737fdc058c255f7d369c710837690a8b6886d248948531f43d0f1f1d74b925fec5b1d010c7edb9c833f57e04
- SSDEEP
  
  49152:AnDmgfs007SK625AxaFpGIQ9y4vAcrvZsiGvQ2dxCUaNG8RNTpWUNwwhKXfR:Es0Qk2P7GIQ9y4vlrvZsiGvQ2dxC0
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  
  MtvP2P.exe
- Size
  
  5.9MB
- MD5
  
  c256532149bb511a5616b660f1792c3a
- SHA1
  
  26d0add6702f18a03b365aec9d95683842a29d59
- SHA256
  
  05ba9c02c7871c980a873c7b0f935323f49875a3a536694ddd4f54626c76ca0c
- SHA512
  
  d0dfcaef2e0d883c64ede884e224751a5123d9d7593046089cc469f00bfb9e4f592fdfd9c7caa667efb7b5a8681bb681606b1a68bc87446a9b013ac3e49f25c5
- SSDEEP
  
  98304:xMGbGTwx49Y7GbHxjtM4wZEx+LYx73CBqGtSfo01T:0wriB8Z2ObKT
Score

6^/10

adware discovery persistence stealer
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Adds Run key to start application

Installs/modifies Browser Helper Object

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32