MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b698af43c10c0509d15d39d688674f9885295a4679a4f6afffcf1714322c7a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 8b698af43c10c0509d15d39d688674f9885295a4679a4f6afffcf1714322c7a7
SHA3-384 hash: 7e4ddd86070efaa5d7892464dddb9fbabdda492617452994d5b21717ff16d090f99a1282a23461582b7cfcd71810c706
SHA1 hash: 4885954a21da7830c78186d2c719d51bc3625508
MD5 hash: b6d68b57d6d3278a52c6235d8b35ffcb
humanhash: cardinal-orange-diet-mango
File name:pandabanker_2.2.5.vir
Download: download sample
Signature PandaZeuS
File size:235'016 bytes
First seen:2020-07-19 19:46:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 6144:gOxh1KHEhxth6KOrD/6E7ibItegplor/hy5vr:gOjeEF4KOrCbRr/Q
TLSH 3434021697E85137CE2EDA70E07664043731BF010A74EB6F10BAA5AF1DB37D90650BB6
Reporter @tildedennis
Tags:pandabanker PandaZeuS


Twitter
@tildedennis
pandabanker version 2.2.5

Intelligence


File Origin
# of uploads :
1
# of downloads :
45
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Detection:
ZeusPanda
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending an HTTP GET request
Creating a file in the %temp% subdirectories
Reading critical registry keys
Creating a file
Deleting a recently created file
Reading Telegram data
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a TCP request to an infection source
Stealing user critical data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247531 Sample: pandabanker_2.2.5.vir Startdate: 20/07/2020 Architecture: WINDOWS Score: 100 56 Malicious sample detected (through community Yara rule) 2->56 58 Antivirus / Scanner detection for submitted sample 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 3 other signatures 2->62 9 pandabanker_2.2.5.exe 3 2->9         started        13 CachedImage_1280_1024_POS4.exe 2 2->13         started        15 CachedImage_1280_1024_POS4.exe 2->15         started        process3 file4 46 C:\Users\user\...\pandabanker_2.2.5.exe.log, ASCII 9->46 dropped 86 Drops batch files with force delete cmd (self deletion) 9->86 88 Injects a PE file into a foreign processes 9->88 17 pandabanker_2.2.5.exe 5 9->17         started        21 CachedImage_1280_1024_POS4.exe 13->21         started        23 CachedImage_1280_1024_POS4.exe 15->23         started        signatures5 process6 file7 42 C:\Users\...\CachedImage_1280_1024_POS4.exe, PE32 17->42 dropped 44 C:\Users\user\AppData\...\upd91d5bb48.bat, DOS 17->44 dropped 64 Drops executable to a common third party application directory 17->64 66 Tries to detect sandboxes / dynamic malware analysis system (registry check) 17->66 68 Tries to detect sandboxes / dynamic malware analysis system (mutex check) 17->68 70 Tries to detect sandboxes / dynamic malware analysis system (tool check) 17->70 25 CachedImage_1280_1024_POS4.exe 3 17->25         started        28 cmd.exe 1 17->28         started        30 WerFault.exe 21->30         started        signatures8 process9 signatures10 78 Antivirus detection for dropped file 25->78 80 Multi AV Scanner detection for dropped file 25->80 82 Machine Learning detection for dropped file 25->82 84 Injects a PE file into a foreign processes 25->84 32 CachedImage_1280_1024_POS4.exe 25->32         started        35 conhost.exe 28->35         started        process11 signatures12 48 Writes to foreign memory regions 32->48 50 Allocates memory in foreign processes 32->50 52 Creates a thread in another existing process (thread injection) 32->52 54 Injects a PE file into a foreign processes 32->54 37 svchost.exe 2 32->37         started        40 svchost.exe 32->40         started        process13 signatures14 72 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 37->72 74 Overwrites code with function prologues 37->74 76 Monitors registry run keys for changes 37->76
Threat name:
ByteCode-MSIL.Trojan.Inject
Status:
Malicious
First seen:
2016-07-03 03:13:11 UTC
AV detection:
22 of 29 (75.86%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion spyware persistence
Behaviour
Suspicious use of WriteProcessMemory
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Modifies system certificate store
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Adds Run key to start application
Adds Run key to start application
Checks BIOS information in registry
Reads user/profile data of web browsers
Identifies Wine through registry keys
Loads dropped DLL
Deletes itself
Identifies Wine through registry keys
Reads user/profile data of web browsers
Checks BIOS information in registry
Executes dropped EXE
Looks for VMWare Tools registry key
Looks for VMWare Tools registry key
Executes dropped EXE
Looks for VirtualBox Guest Additions in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Threat name:
Unknown
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments