Panda Banker: New Banking Trojan Hits the Market

Share with your network!


The Zeus banking Trojan has made the rounds in various incarnations since 2007, allowing threat actors to steal hundreds of millions of dollars and install a variety of additional malware on vulnerable PCs. Now Proofpoint researchers have been tracking a new banking Trojan with roots in Zeus. We have observed the malware, dubbed "Panda Banker", being used for targeted attacks via email attachments. We are also tracking its use in broad attacks via at least 3 different exploit kits (EKs). The configuration of the banker also contains injects for Australian and UK banks.

Thanks to Fox IT InTELL [3], which discovered this malware in February and allowed us to properly name it in our signatures. The analysis below is a result of our ongoing observations of Panda Banker campaigns.


“Gert.exe” Email Campaign

On March 10, we detected a targeted email with a Microsoft Word attachment (SHA: bdc912caf9b9e078bc7bd331deacae9c460c8e8893442048b9474790c52e1ab9). It exploits the vulnerabilities CVE-2014-1761 and CVE-2012-0158. This email was sent to individuals working at mass media and manufacturing corporations. Upon successful exploitation, the document downloaded Panda Banker from 78.128.92[.]31/gert.exe, a subnet previously used for other targeted attacks [1].

Exploit document that downloads gert exe
Figure 1: Exploit document that downloads gert.exe

“Panda.dat” Email Campaign

On March 19, we detected a targeted email with a Microsoft Word attachment (SHA: 6dc0bd77e51eb9af143c749539bd638020d557083479bcd4c4b9639fe61eb0f8) that used an Xbagging (aka Bartallex) downloader macro [2]. This email was sent to only a few individuals working at financial organizations. The attachment downloaded an intermediary “GODZILLA” loader [3] which in turn downloaded Panda Banker.

Macro-laden attachment that downloads intermediary loader which downloads Panda Banker
Figure 2: Macro-laden attachment that downloads an intermediary loader which downloads Panda Banker

Exploit Kits Delivering Panda

We observed at least three different exploit kits delivering Panda Banker since March. These include Angler Exploit Kit, Nuclear Exploit Kit, and Neutrino Exploit Kit. Our observations show that geo-filtering was used to deliver the Panda Banker payload in Australia and UK.

Nuclear EK dropping Panda Banker on March 15, 2016, in the UK
Figure 3: Nuclear EK dropping Panda Banker (C&C alwaysonline[.]pw) on March 15, 2016, in the UK


Angler EK dropping Panda on April 19, 2016, in Australia
Figure 4: Angler EK dropping Panda (C&C secpressnetwork[.]com) on April 19, 2016, in Australia


Figure 5: Nuclear EK dropping Panda on April 19, 2016, in Australia


The banker launches two instances of the svchost process, the first of which sends and receives commands from the C&C server. The bot submits a variety of information to the server, including system uptime, the process in which the malware is running, the current user name, a unique id for the infection, the botnet name, the botnet version (currently 2.1.3), OS version information, latency, local time, computer name, the name of antivirus software installed, installed anti-spyware, and the installed firewall.

The bot submits a variety of information to the server, including:

  • System uptime
  • The process in which the malware is running
  • The current user name
  • A unique id for the infection
  • The botnet name
  • The botnet version (currently 2.1.3)
  • OS version information
  • Latency
  • Local time
  • Computer name
  • The name of antivirus software installed
  • Installed anti-spyware
  • The installed firewall

The server responds with obfuscated JSON data. This data includes URLs from which to download further modules/configs and configuration commands for the modules and the malware overall. The modules include a VNC server (64-bit and 32-bit) module and SOCKS. The various configuration commands available are listed in the screenshot below.

Figure 6: Part of Panda Banker configuration returned from the C&C server

Parts of the configuration are base64 encoded. We observed the following “webfilters” used:

!*localhost* !** !http://* !hxxp://**
!** !** !**
!** !** !**

We also observed the following “webinjects” being used, targeting Australian and UK banks.

“vnc” bonet:


“kan” botnet:


Note that the configuration file may also include commands such as “webinject1data”, “webinject2data”, “webinject3data” and so on, one per targeted bank. The value of this parameter (after base64 decoding) is a JavaScript that contains static code and pulls down additional dynamic code from the malware ATS panel.

Technical Details

Through dynamic analysis we found similarities to Zeus banker. For example, Panda Banker creates typical Zeus mutexes, files, folders and registry keys. Hence, we suspect that this malware is borrowing code from Zeus.

Figure 7: Mutexes created are similar to those created by Zeus; the sandbox identifies them as such


Figure 8: The registry keys created are similar to Zeus


Figure 9: Sandbox detection of malware hooking network APIs, again, similar to behavior seen with Zeus

For persistence across reboot, the malware creates a registry key in the existing JavaScripts folder (part of the Adobe installation already present on the user’s machine).

Figure 10: Persistence mechanism

The malware performs a connectivity check to the Russian search engine yandex[.]com. Following that, POSTs to the actual C&C server are observed.

Figure 11: C&C communication, example POST

Several examples of URL patterns used to communicate with the C&C are shown below:


Some of the Panda Banker C&C servers use Fast flux DNS, and have numerous IP addresses associated with a single malicious domain, making the malware more resistant to counter-measures.

Figure 12: Fast flux DNS used with secpressnetwork[.]com C&C server (screenshot from PassiveTotal)

ATS and Control Panel

The Automatic Transfer System (ATS) is a type of banking web inject that automates online bank portal actions, such as money transfer, and Panda Banker uses such an injects system. An example Panda Banker ATS/injects panel is shown below. It shows the status of grabber modules, ATS, Intercepts, and known infected machines.

Figure 13: Web injects panel showcasing the Grabbers (stealers), Intercepts, and ATS options


Figure 14: Web injects panel showcasing the Jabber notification settings

Panda Banker uses a separate page for its control panel:

Figure 15: C&C Panel showing “Panda” in the title bar


Banking Trojans like Zeus, Dyre, Tinba, and Dridex have netted cybercriminals billions of dollars by stealing banking credentials and, in many cases, generating fraudulent transactions. Many of these Trojans have also been observed installing additional malware like ransomware, while some have been modified to steal credentials from industrial control systems and launch attacks outside the banking industry.

It's no surprise, then, that a new banker - in this case, Panda Banker - has come on the scene, complete with a variety of information stealing mechanisms. Like many modern banking Trojans, Panda Banker appears to have roots in Zeus with sophisticated means of establishing persistence and uses in both targeted and widespread attacks.

Proofpoint will continue to monitor this new banker and provide additional updates as details emerge.



Indicators of Compromise (IOC)

Table 1: Indicators of Compromise


IOC Type




Panda Banker



Panda Banker



Panda Banker



Panda Banker



Panda Banker C&C



Panda Banker C&C



Panda Banker C&C



Document dropping Panda Banker C&C



Document dropping Panda Banker C&C



Zip archive containing most of the samples mentioned


Select ET Signatures that would fire on such traffic:

2022609 || ET TROJAN panda banker C&C