41ac9dd172ebc186c77cab9f12401ab18805e77c34eacdf9dfdbd570d8bd9c62 | Triage

Sharing

General

Target

pandabanker_2.6.7.vir
Size

293KB
Sample

200719-jr9gntnfmn
MD5

2526818feedf1748fa0de8ee290ad9ee
SHA1

cd67a0ebd40d88d6d2f9b8df9b9c729479dad4f6
SHA256

41ac9dd172ebc186c77cab9f12401ab18805e77c34eacdf9dfdbd570d8bd9c62
SHA512

a50aeb2751592e3c51a851ff3e5daff131af22fd541ba16de93cfe6f17dd8ec3f5799b6ffc73207ee90004f6724db0ebb0efe0fb0ea6811abb414337e9812a59

Score

8^/10

evasion persistence spyware

Malware Config

Targets

- Target
  
  pandabanker_2.6.7.vir
- Size
  
  293KB
- MD5
  
  2526818feedf1748fa0de8ee290ad9ee
- SHA1
  
  cd67a0ebd40d88d6d2f9b8df9b9c729479dad4f6
- SHA256
  
  41ac9dd172ebc186c77cab9f12401ab18805e77c34eacdf9dfdbd570d8bd9c62
- SHA512
  
  a50aeb2751592e3c51a851ff3e5daff131af22fd541ba16de93cfe6f17dd8ec3f5799b6ffc73207ee90004f6724db0ebb0efe0fb0ea6811abb414337e9812a59
Score

8^/10

evasion spyware persistence
- Executes dropped EXE
- Deletes itself
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionspywarepersistence

behavioral2

evasionspywarepersistence