Overview

overview

10

Static

static

1

a88d1914a8...18.exe

windows7-x64

10

a88d1914a8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a88d1914a8879ab730ff1ba9c2f2f585_JaffaCakes118

  • Size

    3.1MB

  • Sample

    241127-s4nzmswkdj

  • MD5

    a88d1914a8879ab730ff1ba9c2f2f585

  • SHA1

    4f7d01d8c20f1137ed2621281d2824d397df1be7

  • SHA256

    c98de3d6b0dc4e9f54a1de1a10c8ed0f746a7c03eb71424855ca2b0ed850d4f7

  • SHA512

    f1e3fad1ae30c7f1d8fad3f4f2e9ce70e590128e45429a40e090f22621ab2c23acb4b83e5e921cfc83ed05ae743f806a1c38e89b3b8b12b5b63f9f61d7ebe2f3

  • SSDEEP

    49152:qTNVoeuNhGQl8kwNGOZQtlKPwOxConN8PyowDHW+va4apRMVNTPAwRh1az:qTNVoeuNItNOawmCMD2+y4GIbY

Score
10/10
pandastealerdiscoverystealer

Malware Config

Targets

    • Target

      a88d1914a8879ab730ff1ba9c2f2f585_JaffaCakes118

    • Size

      3.1MB

    • MD5

      a88d1914a8879ab730ff1ba9c2f2f585

    • SHA1

      4f7d01d8c20f1137ed2621281d2824d397df1be7

    • SHA256

      c98de3d6b0dc4e9f54a1de1a10c8ed0f746a7c03eb71424855ca2b0ed850d4f7

    • SHA512

      f1e3fad1ae30c7f1d8fad3f4f2e9ce70e590128e45429a40e090f22621ab2c23acb4b83e5e921cfc83ed05ae743f806a1c38e89b3b8b12b5b63f9f61d7ebe2f3

    • SSDEEP

      49152:qTNVoeuNhGQl8kwNGOZQtlKPwOxConN8PyowDHW+va4apRMVNTPAwRh1az:qTNVoeuNItNOawmCMD2+y4GIbY

    Score
    10/10
    pandastealerdiscoverystealer

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

      stealerpandastealer

    • Pandastealer family

      pandastealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks