Zeus Panda

Zeus Panda is a Trojan designed to steal banking information and other sensitive credentials for exfiltration. Zeus Panda’s original source code was leaked in 2011, allowing threat actors to use its source code as a basis for new malware variants. It is mainly used to target Windows operating systems ranging from Windows XP through Windows 10.[1][2]

ID: S0330
Platforms: Windows

Version: 1.0

Techniques Used

EnterpriseT1115Clipboard DataZeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.[2]
EnterpriseT1059Command-Line InterfaceZeus Panda can launch an interface where it can execute several commands on the victim’s PC.[2]
EnterpriseT1140Deobfuscate/Decode Files or InformationZeus Panda decrypts strings in the code during the execution process.[1]
EnterpriseT1083File and Directory DiscoveryZeus Panda searches for specific directories on the victim’s machine.[2]
EnterpriseT1107File DeletionZeus Panda has a command to delete a file.[2]
EnterpriseT1179HookingZeus Panda hooks processes by leveraging its own IAT hooked functions.[2]
EnterpriseT1070Indicator Removal on HostZeus Panda can uninstall scripts and delete files to cover its track.[2]
EnterpriseT1056Input CaptureZeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.[2]
EnterpriseT1112Modify RegistryZeus Panda modifies several Registry keys under HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\ to disable phishing filters.[2]
EnterpriseT1027Obfuscated Files or InformationZeus Panda encrypts strings with XOR and obfuscates the macro code from the initial payload. Zeus Panda also encrypts all configuration and settings in AES and RC4.[1][2]
EnterpriseT1086PowerShellZeus Panda uses PowerShell to download and execute the payload.[1]
EnterpriseT1057Process DiscoveryZeus Panda checks for running processes on the victim’s machine.[2]
EnterpriseT1055Process InjectionZeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.[2]
EnterpriseT1012Query RegistryZeus Panda checks for the existence of a Registry key and if it contains certain values.[2]
EnterpriseT1060Registry Run Keys / Startup FolderZeus Panda adds persistence by creating Registry Run keys.[1][2]
EnterpriseT1105Remote File CopyZeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.[2]
EnterpriseT1113Screen CaptureZeus Panda can take screenshots of the victim’s machine.[2]
EnterpriseT1064ScriptingZeus Panda can launch remote scripts on the victim’s machine.[2]
EnterpriseT1063Security Software DiscoveryZeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.[1][2]
EnterpriseT1071Standard Application Layer ProtocolZeus Panda uses HTTP for C2 communications.[1]
EnterpriseT1082System Information DiscoveryZeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.[1][2]
EnterpriseT1124System Time DiscoveryZeus Panda collects the current system time (UTC) and sends it back to the C2 server.[2]