pandastealer | 4bf58bc8ffd4c4ea3b36aa4cadf6b99b389009bd9497064037ee3d1f9191e430

Sharing

Copy URL Twitter E-mail

General

Target
ccsetup226.exe
Size 3.2MB
Sample260713-ahhlmact41
SHA256 4bf58bc8ffd4c4ea3b36aa4cadf6b99b389009bd9497064037ee3d1f9191e430
MD5 d3f8f4b1fd52f34349521f2275555927
SHA1 dc51386d4b48cac7d866653776905594000ceaee
SHA512 3904d564d432d88864d3f06750006e4bcc248918eda976182192794e39d07d9f7a144961cc705c16e5eabda30db06dcff10585331d4986f9a88884d3fd7571ef
SSDEEP 98304:0OFi8uh2oD6Lbnn82ZaRCiWPl8p99H+H0X9PJqD:0W0n63nnLi4S+YRA
TLSH
T1A6F533154B5368D9FD08FD7480E6C76FA722BD02AA8899477B11BF150933092BF292DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ccsetup226.exe
- Size 3.2MB
- SHA256 4bf58bc8ffd4c4ea3b36aa4cadf6b99b389009bd9497064037ee3d1f9191e430
- MD5 d3f8f4b1fd52f34349521f2275555927
- SHA1 dc51386d4b48cac7d866653776905594000ceaee
- SHA512 3904d564d432d88864d3f06750006e4bcc248918eda976182192794e39d07d9f7a144961cc705c16e5eabda30db06dcff10585331d4986f9a88884d3fd7571ef
- SSDEEP 98304:0OFi8uh2oD6Lbnn82ZaRCiWPl8p99H+H0X9PJqD:0W0n63nnLi4S+YRA
- TLSH
  T1A6F533154B5368D9FD08FD7480E6C76FA722BD02AA8899477B11BF150933092BF292DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
- TLSH
  T172622A11778888F3DB92013EB4533707AF9D5126B4929ED2CA271FC66D2B09D3EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 2a7f33ef64d666a42827c4dc377806ad97bc233819197adf9696aed5be5efac0
- MD5 a401e590877ef6c928d2a97c66157094
- SHA1 75e24799cf67e789fadcc8b7fddefc72fdc4cd61
- SHA512 6093415cd090e69cdcb52b5d381d0a8b3e9e5479dac96be641e0071f1add26403b27a453febd8ccfd16393dc1caa03404a369c768a580781aba3068415ee993f
- SSDEEP 48:iV6sAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Joof5d2:2V11GED5ZTvycNSmwVsTJuftpZR0Ld2
- TLSH
  T198C18333B3C24AF6D6950633252373C366539E342359804F9B6712AA2920CFBDD6E793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- MD5 00a0194c20ee912257df53bfe258ee4a
- SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T113325B5993A0C1F3D5A0823C0DA73A7B1379722016B14FA3CFA35841AE196D7AC7D237
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $TEMP/ytb.exe
- Size 2.2MB
- SHA256 7ab505da56855344404834de64efa3c3bf396cb051f09f849c5ec24c1dacb0a5
- MD5 f0745c1e12ff5179d8452d162fa5369a
- SHA1 84ffda6e09fa86dd78d886854f24c1fbef04b257
- SHA512 0e6e973993da04451565347e6c4fddf7e677aceb136da3a5c11230ceab082829671b5f711ea6e1447f30da368207b95cdaa974251d9cf56494c007ba1cad10a1
- SSDEEP 49152:sLDL9QwXSoBJQX19YDSWWAoL5QnqAHYcFPw3tdq:sLUoUKIbMqoYcC9dq
- TLSH
  T1B1A533D38587F5CFE6E142B21C35A473806CAF8F1641406F9763BCEDAA7A487E047299
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral10 behavioral9
- Target
  content/ytoolbar/dialog.js
- Size 3KB
- SHA256 4e5aef8de1e1d533ce010ce31c462f9f443b8450fda53ccc8340715af116eb55
- MD5 d70400ffb5f32c6f436b7e30c5ad1970
- SHA1 0724a32cc3a74e4e60687c83855e5a91f5517b55
- SHA512 76bbcae2b7f9e437cf7681ae3d0abd8a0740c0152080af706113bea2988d969470cab1aff42cf74e8f3b434a666342a3a10154d158d7ed71d6ae0fa5f1c8bb42
- TLSH
  T1C57140783B4C837F2AD013288679D699ECFCD431950DE8E1D1AC992B40A4D609AEF6E5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  content/ytoolbar/feedFunctions.js
- Size 38KB
- SHA256 f5a52444a68219d125b063ac021244f15bfa2f359bdb82bb37fc0eb444857e74
- MD5 f95d072934fc40ad4cee569f00ed66f1
- SHA1 3afa9919dab0322fc01693fcb4dc84a5ec60709e
- SHA512 c3b1b787a6bb9c3dca63f5846109ee90324f300165008ce0378f97ecf6e537a7539089f763af6f0dd754aa65354af59411a7b80d81ce905e227b5b451b01cd00
- SSDEEP 384:gQ04nYwfO71GiqdJ87Migl+wUktjvh7rbHMYL0+lyiT8xDhD06z5ZSZm+wAPNd5+:gQn2IL8B/oZHzLkiT8zpkZ9S7hUdM/n
- TLSH
  T17F03B669330D226F16E5232846BE34C8EE7CDA71500D84F6BC58E994E4E446DC3EBBB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  content/ytoolbar/fileio.js
- Size 5KB
- SHA256 b967f565195487e3ce6976fbeedf92cbbd9f212bc5bfefad7fc52112dd567915
- MD5 ce97790e485ebe476c74e0c9c5278ade
- SHA1 37972b139a787040adcafbded249af8b220e37a3
- SHA512 a242f0915da59a67007f4f91954b88972ff7c5226830f5200129ce4a022d9d1356bc5e239518f4d3631c1513681f1406593dd2c88e8cecb434611e255afc8867
- SSDEEP 96:vkiCEh7Vu4MfMVIHr952YBglwBPqmkZ5C7YFtJ6Z9Ebt+:vkte7w4z2QYBCwIbs7utJ+ut+
- TLSH
  T1C7C156AD364D112F07E112A45BBC2847ECADD067492D41F4F1F9966CA4E0E09C3EC7E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  content/ytoolbar/globals.js
- Size 2KB
- SHA256 f63a635481cd77445d7052703cf556916569b3d846fbce3651dcf5482cbd55a2
- MD5 5101baa849b4b4726df8e49869405dca
- SHA1 d26d2462501a114585778c113130f3f2598ac0dd
- SHA512 81d3bad455c5149968b3edfc4f87eb32f8c1e2579b8019ad2f7cef92ad3c1f79da8714f0964929f54d480581a060825b33427c691b0ac0c14d13333a14946f15
- TLSH
  T1725102A673905CE7096252200BCF13EF69E5C402584DC26ABC7DF74473EA98FC0B45AA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  content/ytoolbar/history.js
- Size 5KB
- SHA256 54b6122ab0144c35370e42c84ac44590583b94ef20ccb73add66d53bc8c54075
- MD5 015adce6b2abac3f1e38501168c3dd31
- SHA1 fdb20102aa6ac36e3f954852228a091102c7943b
- SHA512 89cfb44a4d0f1c2432c300097ca4e92ec9ba09a4b811062519180521b7fc6fdb0098a922910b3940fa6352eef02f5e5215d960fb2420f91b125db000be68e5ca
- SSDEEP 96:gOSFoVHFE8VgiucTtItVx9Im9nRAk+7jXyrrt2d80H1V/ghtyA:gOSoVHFGcETImAk4Xyrrt0861V/utJ
- TLSH
  T1FBB13283335C502F59FA13280AF671C8FE7DD5B2A90A60F4B0F86CA8E6E4D1193E5675
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  content/ytoolbar/i18n.js
- Size 605B
- SHA256 6a34b9965e82b6b3808498336d5e208622fdc1af6628825579d51b7dc0377cd0
- MD5 0346d7c367761d96bde9354d97da3f0e
- SHA1 e2de654d6eb3989f9cc09f95e1fbe18b4ab76984
- SHA512 7e3e4ffb0673ff1e9275fa48eb20f7a956154d9a9b76bc5eb638b3ef4a3cd621a8ac2b5cf78e46b63c945677a149fd11b60f8de8ec3e8845cfd7c41dd0b0cb30
- TLSH
  T1A7F00CEB300A80375298258790F6698CFCF8EE30473FACF9F480A04A9424C3D22FD284
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  content/ytoolbar/installerVariables.js
- Size 357B
- SHA256 030eb8eb073f0a1e81e24e53925c760c5ebb3c41f24eeb2c0237ee85875c6bf1
- MD5 b9221e098729435e47a169c5809edec1
- SHA1 5c3feec55ba5dc583d826453f70f165f503664ca
- SHA512 65f18e629c64001621ae0434e8cccd588b48424837092087245453457e42dc0d81f24ac67b6777d6af13e57923f10b2b3ce9cff386235a101c7642ef868e9a4d
- TLSH
  T1C3E0480C4B31B1F2B3A2A3BF47939C248014B272605D647519F353450757919F0808FB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  content/ytoolbar/network.js
- Size 2KB
- SHA256 94b709bfb3edd15281fbd34398357710dc6864bb08fc36223675223251531236
- MD5 e93c0d2fdb46f417203dbdac78167c2a
- SHA1 5bc82b03fd9e886f947fca32d3da9ffb560cd4fe
- SHA512 5f3dae338adae08c2db179bb2458efc17fc4df3b3bf3ddd4721abd296806e372ec5727d653b65b4d470719ce118b599a1a75605aa39810adc62f626fe00c8a01
- TLSH
  T13F5142EDB72C610B06D42046437E2614EDBDF8E1571D84E1B516E989E898A24F2FC7D1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  content/ytoolbar/options.js
- Size 6KB
- SHA256 384b41fc1aaf4854ebc5252d2b171c87031c19504705d2a7d58b09511be9d2e9
- MD5 bdb6d9e09b0cf1981181017c361b88c2
- SHA1 c3ddae4f9236d2754b9660ffc1ace7915625e355
- SHA512 bfd45b2773cfc40643ce643906a249395794e8c75d36065df4ea8fdebe47e8b0a4d85d3256bf2838920bfdbdc927ab71ee18f43eb06cb30ec92223822230105c
- SSDEEP 96:gV54Ch9LQxwc4EUWkF71sGAZssa6CjsstLfGqpXJls/DHxrN8RGALIlA2pP0:gViChQwcm7q7ZZa/jZRZU/DnAZ2pc
- TLSH
  T179D1339B72D8113B47FB12B9047C6459ED78CD21951FE8D164B88D9884B8E24D3DBFB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  content/ytoolbar/setHomepage.js
- Size 7KB
- SHA256 566032ea3b7a7f94ef750df96027ef62a974d27fe25749f87240d2375e791086
- MD5 89f33cca146d786ae3c2722de8b01ae4
- SHA1 d5ee5ca7301bb63313930178a83727925755e939
- SHA512 ed26c0b8fe5aec832a5cdd2ee49f471ca4a8ed05a786900ef802f2fa51b62dd2bef003847df2b3233bfcbbe04ff6ef9f28452cd1ed06e9afe929084ecbf39a2f
- SSDEEP 192:gAabDHZSAFtpDocsZzFSOZ2UL1GdXKHWdXKQgctulAr:gdbDHZSaOTGdGWdDr
- TLSH
  T114F1B973324A01760EF52360657868D9FC9AC030D99EE461B27CD005A560EAEF3DB7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  content/ytoolbar/toolbarBuilder.js
- Size 24KB
- SHA256 16e6dd88c7a2c2fccceec7bfd76917ac5ead431f91fb1ad2ee72676a134daaa1
- MD5 519d19d54d592de7e6113ea25626916f
- SHA1 335a1e4c8f0728605435f6574a24ce2d3ff0d692
- SHA512 fc5afc11d3a2ed5eb922ac9d7ffca33cd6fd03c68a0a6d25a47240daf2adb546cb0d168ec30e4420c43513fd711e5b8025fb0d1d8338737d046d5f9f92c6b4ce
- SSDEEP 384:gELap5tkE3rN5JN2edPbuP0wzudddRze+qUCExAheoIk/xHIPN:gELfE7N5JpdTAjGcUCEx0IsdCN
- TLSH
  T1A7B2637A33AD437F1AAB231855F85198EE2CC430471FA4F1787CB59D50E8CA093EA6E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32