ouroboros | dac11aa9a60e91e8370a216e95c059758a3dd0f960d354f71c7975abac675122 | Triage

Submit
Reports

Overview

overview

Static

static

5

dac11aa9a6...22.exe

windows7-x64

dac11aa9a6...22.exe

windows10-2004-x64

8

Sharing

General

Target

dac11aa9a60e91e8370a216e95c059758a3dd0f960d354f71c7975abac675122.exe
Size

1.3MB
Sample

241124-gxvm3axmhv
MD5

6036ccabba8a405dbc98cfa3171f4019
SHA1

dfffc5f90e5c4f207f5d772a1db64b13b6e003f8
SHA256

dac11aa9a60e91e8370a216e95c059758a3dd0f960d354f71c7975abac675122
SHA512

c8ceb801770756800abf2a57cd2a9e6245acbc7975ceed0adea2ce0512eb07229e452bf5e6e994ab37f7084ed0845f9308f903cba6cd82a36507897d392762bf
SSDEEP

24576:XN4EfsPHd9VbyiKSnKMnsNneRWrN2jHwTxbMmgCyq3eca44zpRPtHSr:9z0/0iKSnKYsNn4WZ2LwQNGeca4aPl2

Score

10^/10

ouroboros pandastealer discovery evasion persistence privilege_escalation ransomware stealer upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

dac11aa9a60e91e8370a216e95c059758a3dd0f960d354f71c7975abac675122.exe

Resource

win7-20240903-en

ouroboros pandastealer discovery evasion persistence privilege_escalation ransomware stealer upx

windows7-x64

17 signatures

120 seconds

Behavioral task

behavioral2

Sample

dac11aa9a60e91e8370a216e95c059758a3dd0f960d354f71c7975abac675122.exe

Resource

win10v2004-20241007-en

discovery evasion persistence privilege_escalation upx

windows10-2004-x64

10 signatures

120 seconds

Malware Config

Targets

- Target
  
  dac11aa9a60e91e8370a216e95c059758a3dd0f960d354f71c7975abac675122.exe
- Size
  
  1.3MB
- MD5
  
  6036ccabba8a405dbc98cfa3171f4019
- SHA1
  
  dfffc5f90e5c4f207f5d772a1db64b13b6e003f8
- SHA256
  
  dac11aa9a60e91e8370a216e95c059758a3dd0f960d354f71c7975abac675122
- SHA512
  
  c8ceb801770756800abf2a57cd2a9e6245acbc7975ceed0adea2ce0512eb07229e452bf5e6e994ab37f7084ed0845f9308f903cba6cd82a36507897d392762bf
- SSDEEP
  
  24576:XN4EfsPHd9VbyiKSnKMnsNneRWrN2jHwTxbMmgCyq3eca44zpRPtHSr:9z0/0iKSnKYsNn4WZ2LwQNGeca4aPl2
Score

10^/10

ouroboros pandastealer discovery evasion persistence privilege_escalation ransomware stealer upx
- Ouroboros family
  ouroboros
- Ouroboros/Zeropadypt
  Ransomware family based on open-source CryptoWire.
  ransomware ouroboros
- Panda Stealer payload
- PandaStealer
  Panda Stealer is a fork of CollectorProject Stealer written in C++.
  stealer pandastealer
- Pandastealer family
  pandastealer
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ouroborospandastealerdiscoveryevasionpersistenceprivilege_escalationransomwarestealerupx

behavioral2

discoveryevasionpersistenceprivilege_escalationupx

© 2018-2024

Terms | Privacy