pandastealer | 2025-04-12_55a8e7c230d9b4f64976d04eafc4d34d_elex_mafia_remcos | Triage

Sharing

General

Target

2025-04-12_55a8e7c230d9b4f64976d04eafc4d34d_elex_mafia_remcos
Size

6.9MB
MD5

55a8e7c230d9b4f64976d04eafc4d34d
SHA1

79fb2106193b92447f279c381bbc7cf02d2c0d77
SHA256

a0058a18bed9da11dcafaa88ac2ad9d7a18088cc64226edb260f1ae2e499c401
SHA512

51ded7b97c9e5ffaa91307684701428a90a72f0c2e1e7a62811e0a2961fb3a79025c973730ed351172dd722c7b3adbb6f3b1949b34d434eb05ba09dff528ed37
SSDEEP

49152:NqcQFTIOZeVJzttyVY81DasilJoab20Maoc5+OcoP1xbaHdLHkJEZ11QAfloTpc8:ccQUOO81DaLlJoab8aocpj+DheTpoTIt

Score

10^/10

pandastealer

Malware Config

Signatures

Panda Stealer payload 1 IoCs

resource	yara_rule
sample	family_pandastealer

Pandastealer family
pandastealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-04-12_55a8e7c230d9b4f64976d04eafc4d34d_elex_mafia_remcos

Files

2025-04-12_55a8e7c230d9b4f64976d04eafc4d34d_elex_mafia_remcos
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\sd\Documents\SharpDevelop Projects\VirusMSILNominatusStorm\VirusMSILNominatusStorm\obj\Debug\VirusMSILNominatusStorm.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ