Overview

overview

8

Static

static

pandabanke...ir.exe

windows7_x64

8

pandabanke...ir.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pandabanker_2.6.1.vir

  • Size

    253KB

  • Sample

    200719-42vka26zee

  • MD5

    7d898b1260c0ea760c1de7d586cf8527

  • SHA1

    c11ef05a0f716eb99a3d0eaf9ae9c1f1ca2fb6fd

  • SHA256

    b66eace0a610e947b3aa9964f0ff8e94978c19f290ca377b1e5e558feca44879

  • SHA512

    4d141137ca7005358ad6fdbc28993e511934ad9a41226fce48696457a7852ec6c1246094b42ede8be2c4e8044eca5cbe1e12181cf0cab6c4f5840ed445211f74

Score
8/10
evasionpersistencespyware

Malware Config

Targets

    • Target

      pandabanker_2.6.1.vir

    • Size

      253KB

    • MD5

      7d898b1260c0ea760c1de7d586cf8527

    • SHA1

      c11ef05a0f716eb99a3d0eaf9ae9c1f1ca2fb6fd

    • SHA256

      b66eace0a610e947b3aa9964f0ff8e94978c19f290ca377b1e5e558feca44879

    • SHA512

      4d141137ca7005358ad6fdbc28993e511934ad9a41226fce48696457a7852ec6c1246094b42ede8be2c4e8044eca5cbe1e12181cf0cab6c4f5840ed445211f74

    Score
    8/10
    evasionspywarepersistence

    • Executes dropped EXE

    • Deletes itself

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks