MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d61cc62923f2df6a74fd877cc41c5a4df61355a3ded608bab7b9dde0fb98f41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 0d61cc62923f2df6a74fd877cc41c5a4df61355a3ded608bab7b9dde0fb98f41
SHA3-384 hash: 3dd1fc4e3cb4910d1f6d725afe5673fc1ae239491bd889da017788bed214fc1f22e0d22f085ee6a27847e0ad591fc0d9
SHA1 hash: 6a7a319ae1472ef36a73bf3088706ed6acceff76
MD5 hash: 9a9734e363a41dcacff3cba04c8d9512
humanhash: purple-papa-vegan-venus
File name:pandabanker_2.2.10.vir
Download: download sample
Signature PandaZeuS
File size:227'648 bytes
First seen:2020-07-19 19:34:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d97b76c50ec5fc03dacbb080694ab0e9
ssdeep 3072:A0rmxs/ikDxoz6EDazSUkJU5WeCCc3DvtYhbxuPPRWNfZ:lSkNoz6WCkquCc3zt6bxuENfZ
TLSH EF248B2E79ADA91BC04C803034B9E6734603BD225A514F9A7C55F77E35383622B46FAB
Reporter @tildedennis
Tags:pandabanker PandaZeuS


Twitter
@tildedennis
pandabanker version 2.2.10

Intelligence


File Origin
# of uploads :
1
# of downloads :
27
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Detection:
ZeusPanda
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247373 Sample: pandabanker_2.2.10.vir Startdate: 20/07/2020 Architecture: WINDOWS Score: 100 54 Malicious sample detected (through community Yara rule) 2->54 56 Antivirus / Scanner detection for submitted sample 2->56 58 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->58 60 5 other signatures 2->60 9 pandabanker_2.2.10.exe 2 2->9         started        12 3561288849sdhlie.exe 2 2->12         started        14 3561288849sdhlie.exe 2 2->14         started        process3 signatures4 76 Detected unpacking (changes PE section rights) 9->76 78 Detected unpacking (overwrites its own PE header) 9->78 80 Drops batch files with force delete cmd (self deletion) 9->80 16 pandabanker_2.2.10.exe 5 9->16         started        82 Injects a PE file into a foreign processes 12->82 20 3561288849sdhlie.exe 12->20         started        22 3561288849sdhlie.exe 14->22         started        process5 file6 40 C:\Users\user\...\3561288849sdhlie.exe, PE32 16->40 dropped 42 C:\Users\user\AppData\...\upd715ca6fb.bat, DOS 16->42 dropped 46 Drops executable to a common third party application directory 16->46 48 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->48 50 Tries to detect sandboxes / dynamic malware analysis system (mutex check) 16->50 52 Tries to detect sandboxes / dynamic malware analysis system (tool check) 16->52 24 3561288849sdhlie.exe 2 16->24         started        27 cmd.exe 1 16->27         started        signatures7 process8 signatures9 68 Antivirus detection for dropped file 24->68 70 Multi AV Scanner detection for dropped file 24->70 72 Detected unpacking (changes PE section rights) 24->72 74 3 other signatures 24->74 29 3561288849sdhlie.exe 24->29         started        32 conhost.exe 27->32         started        process10 signatures11 84 Writes to foreign memory regions 29->84 86 Allocates memory in foreign processes 29->86 88 Creates a thread in another existing process (thread injection) 29->88 90 Injects a PE file into a foreign processes 29->90 34 svchost.exe 2 12 29->34         started        38 svchost.exe 29->38         started        process12 dnsIp13 44 akjdfhglaypw3etgfyhsidjbg.club 34->44 62 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 34->62 64 Overwrites code with function prologues 34->64 66 Monitors registry run keys for changes 34->66 signatures14
Threat name:
Win32.Trojan.Zbot
Status:
Malicious
First seen:
2016-11-12 20:25:00 UTC
AV detection:
29 of 31 (93.55%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion spyware persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Adds Run key to start application
Adds Run key to start application
Loads dropped DLL
Identifies Wine through registry keys
Deletes itself
Checks BIOS information in registry
Reads user/profile data of web browsers
Identifies Wine through registry keys
Reads user/profile data of web browsers
Checks BIOS information in registry
Looks for VMWare Tools registry key
Executes dropped EXE
Executes dropped EXE
Looks for VMWare Tools registry key
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Threat name:
Unknown
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments