Extracted

• • Target

    skinchanger.exe

  • Size

    11.6MB

  • MD5

    df6b38c068ba68ca172d27d689d504f5

  • SHA1

    4af19a63f0383f042e3ee0cfbbb7d60639c46515

  • SHA256

    dedd6b62e173bbd5a2775a8ae0c4202ed7c0cc8d5da7999f8e3a04a12598f0ed

  • SHA512

    2d31632c2a5965b9fed4cdfe71077f95a98d1b45c4d4432024f8b849cd8a9423a7949c498cb638922798072116c5891689cfa49d57a63307b49e72e651111944

  • SSDEEP

    196608:94r6c6iLU3kX8PsjmqVNORTpAwyr7K/PxKhB2uKi0lK/xmK6XJ4+U:CucJU3kX9NObzydki0uU5M

  Score

  10^/10

  pandastealerdiscoveryspywarestealervmprotect

  • Panda Stealer payload

  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer

  • Pandastealer family

    pandastealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1