MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80930071626aa46a7ef7ebd2b285d203ebe554ea11d0799bf0395f6cb823a00a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PandaStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80930071626aa46a7ef7ebd2b285d203ebe554ea11d0799bf0395f6cb823a00a
SHA3-384 hash: 29fb55645d6d8ceb09ef16dcb837f5e103090b2e21ccbeecce01c4a4d4a6853154fd287a1e988572b30ec39132269ac7
SHA1 hash: af1424b1d292099d091aa4461ae6502412866176
MD5 hash: a85d7d886197d00f694f2ad8e7aa5b32
humanhash: one-green-moon-snake
File name:a85d7d886197d00f694f2ad8e7aa5b32.exe
Download: download sample
Signature PandaStealer
Create hunting rule
File size:5'789'363 bytes
First seen:2022-08-30 13:02:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4070734502a100c8f90bbd445995533 (11 x CryptOne, 5 x DCRat, 2 x njrat)
ssdeep 98304:juWAuvKS7/fn+k45KJq7UX39Yn51g2MOw29TxmWZ3ElF68JlrcbYrCFmmO+:jkS7/fn25gH9oTw2RxxJElIglDrYt
Threatray 179 similar samples on MalwareBazaar
TLSH T1E5463322F54088B1D3943AB20F19DFA2D47D7AA05FF58CDFB3888A2AB575150D7335A2
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 00e2a6c6c2a6a2b2 (1 x DCRat, 1 x PandaStealer, 1 x CoinMiner)
Reporter abuse_ch
Tags:exe PandaStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a85d7d886197d00f694f2ad8e7aa5b32.exe
Verdict:
Malicious activity
Analysis date:
2022-08-30 13:03:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9bc40528-1465-4f77-8462-62b098dc5188

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/302528/
Detection(s):
Win.Malware.Fugrafa-9938779-0
Create hunting rule

SecuriteInfo.com.IL.Trojan.MSILMamut.499.423.467.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Running batch commands
Moving a system file
Unauthorized injection to a recently created process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/30861/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/630e0b485e025f2e7b0303f4/reports/1c39f111-5542-426c-b0a6-059b1597e3cc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a0a32fc2-2c6f-4c42-a5ac-931057d7e3ac
Result
Threat name:
Panda Stealer, Phoenix Stealer, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1060498
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies power options to not sleep / hibernate
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Potential dropper URLs found in powershell memory
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Uses cmd line tools excessively to alter registry or file data
Uses powercfg.exe to modify the power settings
Writes to foreign memory regions
Yara detected Panda Stealer
Yara detected Phoenix Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 693021 Sample: oX8y79yTcs.exe Startdate: 30/08/2022 Architecture: WINDOWS Score: 100 68 pool.hashvault.pro 2->68 74 Snort IDS alert for network traffic 2->74 76 Malicious sample detected (through community Yara rule) 2->76 78 Antivirus detection for dropped file 2->78 80 10 other signatures 2->80 9 oX8y79yTcs.exe 10 2->9         started        12 svchost.exe 2->12         started        15 svchost.exe 1 1 2->15         started        18 9 other processes 2->18 signatures3 process4 dnsIp5 64 C:\Users\user\...\SIJPFdhsui3sdfSF.exe, PE32+ 9->64 dropped 66 C:\Users\user\...\76587423657325823.exe, PE32 9->66 dropped 20 SIJPFdhsui3sdfSF.exe 6 9->20         started        24 76587423657325823.exe 1 9->24         started        96 Changes security center settings (notifications, updates, antivirus, firewall) 12->96 26 MpCmdRun.exe 12->26         started        72 127.0.0.1 unknown unknown 15->72 file6 signatures7 process8 file9 62 C:\Users\user\AppData\...\WindowsAutHost, PE32+ 20->62 dropped 82 Antivirus detection for dropped file 20->82 84 Multi AV Scanner detection for dropped file 20->84 86 Machine Learning detection for dropped file 20->86 88 Encrypted powershell cmdline option found 20->88 28 cmd.exe 20->28         started        31 cmd.exe 20->31         started        33 powershell.exe 24 20->33         started        35 powershell.exe 20->35         started        90 Writes to foreign memory regions 24->90 92 Allocates memory in foreign processes 24->92 94 Injects a PE file into a foreign processes 24->94 37 AppLaunch.exe 11 24->37         started        40 conhost.exe 24->40         started        42 conhost.exe 26->42         started        signatures10 process11 dnsIp12 98 Uses cmd line tools excessively to alter registry or file data 28->98 100 Uses powercfg.exe to modify the power settings 28->100 102 Modifies power options to not sleep / hibernate 28->102 44 conhost.exe 28->44         started        46 sc.exe 28->46         started        48 sc.exe 28->48         started        58 10 other processes 28->58 50 conhost.exe 31->50         started        52 powercfg.exe 31->52         started        60 3 other processes 31->60 54 conhost.exe 33->54         started        56 conhost.exe 35->56         started        70 95.142.46.35, 49736, 6666 VDSINA-ASRU Russian Federation 37->70 104 Tries to harvest and steal ftp login credentials 37->104 106 Tries to harvest and steal browser information (history, passwords, etc) 37->106 signatures13 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/80930071626aa46a7ef7ebd2b285d203ebe554ea11d0799bf0395f6cb823a00a/
Threat name:
ByteCode-MSIL.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-08-29 20:46:44 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qcjqa4lcnksgu7xx5pjlfbosapv6kvhkchihtg7qhfpwzobduafa._file
Verdict:
malicious
Similar samples:
00926795599d6af73ade5d42b97d88a487024f3169dd625bf20d213a6a3ecba3
PandaStealer
114597ce6ce72d2e30ba0d86e20562c2e6b477838d30ed6ec998f315573bc1ba
PandaStealer
125c425b04053c5817557f7098dc8af428914c9f897c622f6958d80854e41cd8
PandaStealer
6b3260201ea9fb85f2374c809140463ae0e47398c1c8a0c07e54724f82a34c71
PandaStealer
7fbed14d0d7d52a459fc29bae6a62eedd0a69649049b8f9ac37e1297acc3b277
PandaStealer
8a5f86a2cb9c2111306ca704b5c88172857faa5ea6a52f8c86db8e3dd72c58a3
PandaStealer
9f2c2e2bcc9acf06fde3c0066db3befe4f89dad3cc66821c1633c5491eb10a5e
PandaStealer
a457e40931e4867ac655f5a4da7d0e63baf5506a65f525ce89461a9a3413cbe1
PandaStealer
+ 169 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery evasion exploit
Link:
https://tria.ge/reports/220830-qacy6shbgl/
Behaviour
Creates scheduled task(s)
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Modifies file permissions
Executes dropped EXE
Possible privilege escalation attempt
Stops running service(s)
Modifies security service
Unpacked files
SH256 hash:
4b2898d3902e12b409c2f193a764e4f8d9f37a275c3a2a35299a6c71432a654b
MD5 hash:
be636338c96d572e6f035794bf798404
SHA1 hash:
412aa43ee2b2b942ac6b7eceb4371ce78b65ef1c
Link:
https://www.unpac.me/results/3a816515-f0c3-4dcb-b8ae-7101a9c59a2c/
SH256 hash:
80930071626aa46a7ef7ebd2b285d203ebe554ea11d0799bf0395f6cb823a00a
MD5 hash:
a85d7d886197d00f694f2ad8e7aa5b32
SHA1 hash:
af1424b1d292099d091aa4461ae6502412866176
Link:
https://www.unpac.me/results/3a816515-f0c3-4dcb-b8ae-7101a9c59a2c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/80930071626aa46a7ef7ebd2b285d203ebe554ea11d0799bf0395f6cb823a00a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PandaStealer

Executable exe 80930071626aa46a7ef7ebd2b285d203ebe554ea11d0799bf0395f6cb823a00a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2285070/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/302528/

Comments