MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31ed064712da1c70c11c2e157e8469812befb3f051dcd7ffa4de44be49860381. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PandaZeuS


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31ed064712da1c70c11c2e157e8469812befb3f051dcd7ffa4de44be49860381
SHA3-384 hash: 25c46e6d8dc27ae3e70156ae93ee32d4fc569b18f8fc5e50a067b8c1f6d9e3c2188a00602433b74ac3c45b7cc1c677e7
SHA1 hash: 77170d35b865b04ccb7e22f7814c594ccc205827
MD5 hash: 203ec0eda28e1fa47e784adeb312f1b7
humanhash: echo-white-carpet-sodium
File name:pandabanker_2.5.1.vir
Download: download sample
Signature PandaZeuS
Create hunting rule
File size:100'352 bytes
First seen:2020-07-19 19:29:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4967a4ac07d6673b75901758967bbba7 (1 x PandaZeuS)
ssdeep 1536:dLVmuwIiyY+7KChnELlsr18mSRRTG+DgdZGW68HHScQnhNO6v0kS1h9eyCw:dZmnV+eChEp6wTDgdoW68HHcKxvb
Threatray 33 similar samples on MalwareBazaar
TLSH 3CA39E63F9CB40FBE9357A30599E79429AFAFF14095A5E83C3A55C8B5820A10BD1F343
Reporter tildedennis
Tags:pandabanker PandaZeuS


Avatar
tildedennis
pandabanker version 2.5.1

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'884
Origin country :
n/a
Vendor Threat Intelligence
Detection:
ZeusPanda
Create hunting rule
Link:
https://www.capesandbox.com/analysis/28213/
Detection(s):
SecuriteInfo.com.Trojan.Inject3.1602.30934.24561.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending an HTTP GET request
Creating a file in the %temp% subdirectories
Reading critical registry keys
Creating a file
Deleting a recently created file
Reading Telegram data
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a TCP request to an infection source
Stealing user critical data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/390270
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247316 Sample: pandabanker_2.5.1.vir Startdate: 20/07/2020 Architecture: WINDOWS Score: 100 34 Malicious sample detected (through community Yara rule) 2->34 36 Antivirus detection for dropped file 2->36 38 Antivirus / Scanner detection for submitted sample 2->38 40 6 other signatures 2->40 7 pandabanker_2.5.1.exe 5 2->7         started        11 Windows PowerShell ISE.exe 2->11         started        13 Windows PowerShell ISE.exe 2->13         started        process3 file4 28 C:\Users\user\...\Windows PowerShell ISE.exe, PE32 7->28 dropped 30 C:\Users\user\AppData\...\upd19ee830b.bat, DOS 7->30 dropped 48 Drops batch files with force delete cmd (self deletion) 7->48 50 Drops executable to a common third party application directory 7->50 52 Tries to detect sandboxes / dynamic malware analysis system (registry check) 7->52 54 2 other signatures 7->54 15 Windows PowerShell ISE.exe 7->15         started        18 cmd.exe 1 7->18         started        signatures5 process6 signatures7 56 Writes to foreign memory regions 15->56 58 Allocates memory in foreign processes 15->58 60 Creates a thread in another existing process (thread injection) 15->60 62 Injects a PE file into a foreign processes 15->62 20 svchost.exe 2 12 15->20         started        24 svchost.exe 15->24         started        26 conhost.exe 18->26         started        process8 dnsIp9 32 rengima.xyz 20->32 42 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 20->42 44 Creates autostart registry keys with suspicious values (likely registry only malware) 20->44 46 Monitors registry run keys for changes 20->46 signatures10
Detection:
panda
Create hunting rule
Link:
https://mwdb.cert.pl/sample/31ed064712da1c70c11c2e157e8469812befb3f051dcd7ffa4de44be49860381/
Threat name:
Win32.Trojan.Zbot
Create hunting rule
Status:
Malicious
First seen:
2017-09-02 08:19:00 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0d28bf33f99d286092870f3504f54bc0cb81a0f733275d0b689d6bdb9aeb758a
PandaZeuS
335c0e4430a08956f796611b3ebf273117e784ee1d728d7b8fcb9997c98735cc
PandaZeuS
3bbfbe3de9cb174f9d7c579f5e404482778924df85eb4b9daa03a274fc91eb91
PandaZeuS
59e2125782c015d9cad7ae6035eaed1cfab4889ee90ed74888582c784d08fb3b
PandaZeuS
6278fbd54efddf8382ab45329e58e655cb7f82dc86f60028935b96eba9ce16bc
PandaZeuS
634aea27e31c58f7e07510965e6d7350a8cf7e18c5cd5099edcf0586f1990ab9
PandaZeuS
8337b387ec3cafdaa01347f123383682a8bb1e6965a922258fd656a36ebe919d
PandaZeuS
89c7c8a795578ef239fef68fe949c29f50f7f40833f6eb87eabf66cae290eab6
PandaZeuS
c3be55a58b2afa08ba8520d981c50ab773113da36b139985ad16e5fab39ac145
PandaZeuS
db09e6f69ea651370d796ee2fd4a78d9a11cd82faea3f8d5ef007c04065b1e25
PandaZeuS
+ 23 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware persistence evasion
Link:
https://tria.ge/reports/200719-7smedd1abj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Adds Run key to start application
Adds Run key to start application
Loads dropped DLL
Deletes itself
Reads user/profile data of web browsers
Identifies Wine through registry keys
Reads user/profile data of web browsers
Identifies Wine through registry keys
Executes dropped EXE
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/31ed064712da1c70c11c2e157e8469812befb3f051dcd7ffa4de44be49860381

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_pandabanker_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:Zeus_Panda
Create hunting rule
Author:Florian Roth
Description:Detects ZEUS Panda Malware
Reference:https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://zeusmuseum.com/pandabanker/
Cape
Cape
https://www.capesandbox.com/analysis/28213/

Comments