Extracted

• • Target
    Panther-Stealer_1.1.zip
  • Size 1.3MB
  • SHA256 59374e72382a7ae14321a17f5f46e5793e7813c638ea93fb240f6f4046dce73c
  • MD5 0f5afcb6523742996ac1a2a3658fde88
  • SHA1 21ce283a82027fe3881740c743fb87cd851d5d79
  • SHA512 74ff877c5c32a99bca53d1b6b6dd5b9fbeaaa0c92f3fbbb6b329884491bf557cfad4dc5ce6434490f2b39fc5eab30ff7b5d11fc68fd0514e3448aee1d206f21f
  • SSDEEP 24576:soZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR3MU9Q:soZ9bq+MmMEL+hcjXHC/wnwd3MU6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  6^/10

  discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2
• • Target
    Launcher.cmd
  • Size 29B
  • SHA256 2bdfb6a368c2ec0a98d7420653fa4c6304acf09ec0bb26214ec9095631e7b1b7
  • MD5 4ed0a94ac7f2cdaa1d5e87e06722ef6f
  • SHA1 f73430325434d2fb3b16d7aa25b8e97008053c4f
  • SHA512 a1cb279b756fb05293fe33897779a5589d84e90c5e9e1a9fcce9b34f315ca961e90a45384c47eda8a3c53eb3c4cd6292e511b2b5366f622a48e0b67c4259797d
  • MD5 SHA1 SHA512

  Score

  10^/10

  build1discoveryexecutionstealcpersistencespywarestealerupx

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4
• • Target
    lua51.dll
  • Size 3.4MB
  • SHA256 c7a657af5455812fb215a8888b7e3fd8fa1ba27672a3ed9021eb6004eff271ac
  • MD5 4ebd617a3ad9a9619172bd14a902a400
  • SHA1 270f66d2c84ee86ff4b07c6220c51abd4897b5f0
  • SHA512 b008a00d7e57ef4786b14f28aee3880318820dd85d66539263a3f68b547e89bce8db32ad422d4eae6795219ec3ddcd72e7780aed9e725ed3c171d11492e47571
  • SSDEEP 24576:QXEeYq+Fjb1h2Ac9qJqvqj+OhbaijGPDX732ywPKpQlABQFi8ePj40RvzinxO4xS:EEDv/2Ac9qB+OR4n3xBQKvjGQe11Fgl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    luajit.exe
  • Size 98KB
  • SHA256 5343326fb0b4f79c32276f08ffcc36bd88cde23aa19962bd1e8d8b80f5d33953
  • MD5 00f60ee3ff2dee681b5d7d442009b2c2
  • SHA1 f5199b4191add11d02d58f521cbea21465b7ff6b
  • SHA512 6e3754ec8596f3aaed92387c5bd56ee9d65fe54af6f44d2bc89b4df0f670e379137bc5eca5ba8aceb030bd4b45970b3c01f2132d1eef53f5070f9af4d4246562
  • SSDEEP 1536:mmNzk2shF9CXUatIEqTIm4gKN2PwJy4wMUFA8:mmVvtQTKN64wHK8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8
• • Target
    resource.txt
  • Size 333KB
  • SHA256 b1ec642be9b19043d37d0079339ce2326a4b50dab81e482b3a3fa3137f8dc088
  • MD5 9110e3e0df38bb9988ce65d45e79abb1
  • SHA1 27d23084acaf8c8dba3ce16e411cce7736c5618a
  • SHA512 ac69327db399953a34dbff8258524a9201f9dd2a95f6fdcfa87d3fef3e51a0ff07f208e4b8a397a46da828b73fdcd106881feaf15852b9543184b0446f9fdaf9
  • SSDEEP 6144:O+MzxKqO0AyP9oOe9mS6fOejKzNBt+sKOrfY:IAqZ7e9mjKzNBV/M
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  execution
  behavioral10behavioral9