Zeus Panda
Zeus Panda is a Trojan designed to steal banking information and other sensitive credentials for exfiltration. Zeus Panda’s original source code was leaked in 2011, allowing threat actors to use its source code as a basis for new malware variants. It is mainly used to target Windows operating systems ranging from Windows XP through Windows 10.[1][2]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1112 | 修改注册表 |
Zeus Panda modifies several Registry keys under |
|
| Enterprise | T1115 | 剪贴板数据 |
Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.[2] |
|
| Enterprise | T1140 | 反混淆/解码文件或信息 |
Zeus Panda decrypts strings in the code during the execution process.[1] |
|
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
Zeus Panda adds persistence by creating Registry Run keys.[1][2] |
| Enterprise | T1059 | 命令与脚本解释器 |
Zeus Panda can launch remote scripts on the victim’s machine.[2] |
|
| .001 | PowerShell |
Zeus Panda uses PowerShell to download and execute the payload.[1] |
||
| .003 | Windows Command Shell |
Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.[2] |
||
| Enterprise | T1113 | 屏幕捕获 |
Zeus Panda can take screenshots of the victim’s machine.[2] |
|
| Enterprise | T1071 | .001 | 应用层协议: Web Protocols |
Zeus Panda uses HTTP for C2 communications.[1] |
| Enterprise | T1083 | 文件和目录发现 |
Zeus Panda searches for specific directories on the victim’s machine.[2] |
|
| Enterprise | T1012 | 查询注册表 |
Zeus Panda checks for the existence of a Registry key and if it contains certain values.[2] |
|
| Enterprise | T1027 | .010 | 混淆文件或信息: Command Obfuscation |
Zeus Panda obfuscates the macro commands in its initial payload.[1] |
| .013 | 混淆文件或信息: Encrypted/Encoded File |
Zeus Panda encrypts strings with XOR. Zeus Panda also encrypts all configuration and settings in AES and RC4.[1][2] |
||
| Enterprise | T1070 | .004 | 移除指标: File Deletion |
Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.[2] |
| Enterprise | T1614 | .001 | 系统位置发现: System Language Discovery |
Zeus Panda queries the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.[1] |
| Enterprise | T1082 | 系统信息发现 |
Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.[1][2] |
|
| Enterprise | T1124 | 系统时间发现 |
Zeus Panda collects the current system time (UTC) and sends it back to the C2 server.[2] |
|
| Enterprise | T1518 | .001 | 软件发现: Security Software Discovery |
Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.[1][2] |
| Enterprise | T1105 | 输入工具传输 |
Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.[2] |
|
| Enterprise | T1056 | .001 | 输入捕获: Keylogging |
Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.[2] |
| .004 | 输入捕获: Credential API Hooking |
Zeus Panda hooks processes by leveraging its own IAT hooked functions.[2] |
||
| Enterprise | T1057 | 进程发现 |
Zeus Panda checks for running processes on the victim’s machine.[2] |
|
| Enterprise | T1055 | .002 | 进程注入: Portable Executable Injection |
Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.[2] |