General

  • Target

    2025-04-12_55a8e7c230d9b4f64976d04eafc4d34d_elex_mafia_remcos

  • Size

    6.9MB

  • Sample

    250412-tarzwaxxdt

  • MD5

    55a8e7c230d9b4f64976d04eafc4d34d

  • SHA1

    79fb2106193b92447f279c381bbc7cf02d2c0d77

  • SHA256

    a0058a18bed9da11dcafaa88ac2ad9d7a18088cc64226edb260f1ae2e499c401

  • SHA512

    51ded7b97c9e5ffaa91307684701428a90a72f0c2e1e7a62811e0a2961fb3a79025c973730ed351172dd722c7b3adbb6f3b1949b34d434eb05ba09dff528ed37

  • SSDEEP

    49152:NqcQFTIOZeVJzttyVY81DasilJoab20Maoc5+OcoP1xbaHdLHkJEZ11QAfloTpc8:ccQUOO81DaLlJoab8aocpj+DheTpoTIt

Malware Config

Targets

    • Target

      2025-04-12_55a8e7c230d9b4f64976d04eafc4d34d_elex_mafia_remcos

    • Size

      6.9MB

    • MD5

      55a8e7c230d9b4f64976d04eafc4d34d

    • SHA1

      79fb2106193b92447f279c381bbc7cf02d2c0d77

    • SHA256

      a0058a18bed9da11dcafaa88ac2ad9d7a18088cc64226edb260f1ae2e499c401

    • SHA512

      51ded7b97c9e5ffaa91307684701428a90a72f0c2e1e7a62811e0a2961fb3a79025c973730ed351172dd722c7b3adbb6f3b1949b34d434eb05ba09dff528ed37

    • SSDEEP

      49152:NqcQFTIOZeVJzttyVY81DasilJoab20Maoc5+OcoP1xbaHdLHkJEZ11QAfloTpc8:ccQUOO81DaLlJoab8aocpj+DheTpoTIt

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

    • Pandastealer family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

MITRE ATT&CK Enterprise v16

Tasks