Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Инструмент Zeus Panda
Каталоги
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
Риски
Каталоги
MITRE ATT&CK
Инструмент
Zeus Panda
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Zeus Panda

Zeus Panda is a Trojan designed to steal banking information and other sensitive credentials for exfiltration. Zeus Panda’s original source code was leaked in 2011, allowing threat actors to use its source code as a basis for new malware variants. It is mainly used to target Windows operating systems ranging from Windows XP through Windows 10.(Citation: Talos Zeus Panda Nov 2017)(Citation: GDATA Zeus Panda June 2017)
ID: S0330
Type: MALWARE
Platforms: Windows
Version: 1.2
Created: 29 Jan 2019
Last Modified: 18 Aug 2021

Techniques Used
Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Zeus Panda uses HTTP for C2 communications.(Citation: Talos Zeus Panda Nov 2017)
Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Zeus Panda adds persistence by creating Registry Run keys.(Citation: Talos Zeus Panda Nov 2017)(Citation: GDATA Zeus Panda June 2017)
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

Zeus Panda uses PowerShell to download and execute the payload.(Citation: Talos Zeus Panda Nov 2017)
.003 Command and Scripting Interpreter: Windows Command Shell

Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.(Citation: GDATA Zeus Panda June 2017)

Enterprise T1070 .004 Indicator Removal: File Deletion

Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.(Citation: GDATA Zeus Panda June 2017)
Enterprise T1056 .001 Input Capture: Keylogging

Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.(Citation: GDATA Zeus Panda June 2017)
.004 Input Capture: Credential API Hooking

Zeus Panda hooks processes by leveraging its own IAT hooked functions.(Citation: GDATA Zeus Panda June 2017)

Enterprise T1055 .002 Process Injection: Portable Executable Injection

Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.(Citation: GDATA Zeus Panda June 2017)
Enterprise T1518 .001 Software Discovery: Security Software Discovery

Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.(Citation: Talos Zeus Panda Nov 2017)(Citation: GDATA Zeus Panda June 2017)
Enterprise T1614 .001 System Location Discovery: System Language Discovery

Zeus Panda queries the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.(Citation: Talos Zeus Panda Nov 2017)

References

  1. Brumaghin, E., et al. (2017, November 02). Poisoning the Well: Banking Trojan Targets Google Search Results. Retrieved November 5, 2018.
  2. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.