pandazeus | 1003184bbb900185271df36af1af976e8dadde7c994e33899c5d64c5d7723af2 | Triage™

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/10/2026, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Upatre.gagx.exe
Size 258KB
Sample261019-bgna6ade98
SHA256 1003184bbb900185271df36af1af976e8dadde7c994e33899c5d64c5d7723af2
MD5 46bd33f19fab3d16980d1727487e1677
SHA1 0a6f922d0771614178e57394ec3dfc095e2d1f14
SHA512 15e10928bd56ad3e4d8d85886540d5237fa6e31ebc3f9e11bdadd47a9d8013f60c514ba145e31cc767d246683c0208fa83ca010ec18452f37f698d35c484c68b
SSDEEP 6144:l4Y1MyFDm00EO1HwEPj67696+naxxY6JrzZb4zb:4yQ00V1QR76JWbltb4zb
TLSH
T10A448E11A48A8CB9CE410CF908B26773973CBE611B295273F7DA1B75BBD77C0185EA09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker discovery pandazeus trojan

Malware Config

Signatures

Family: PandaZeuS
PandaZeuS is a banking trojan that utilizes the ATS to automate actions within online banking portals.
trojan banker pandazeus

Detects PandaZeuS 2 IoCs

resource	yara_rule
behavioral2/memory/4324-114-0x000000000FE10000-0x000000000FE58000-memory.dmp	family_pandazeus
behavioral2/memory/4324-117-0x000000000FE10000-0x000000000FE58000-memory.dmp	family_pandazeus

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Upatre.gagx.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Upatre.gagx.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Upatre.gagx.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1404337215-1550464601-2805570857-1000\eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a
Size 1KB
SHA256 d52621b11fa2495de3069769fe272ff73ca4e71c4a476e4f773cced2c133aa83
MD5 b27f3b908fbb3d7bced69ece926a016b
SHA1 f176f218557d427a4d652275bf79fe40354bc308
SHA512 4a0d2010089fb147e89742627b5c63f704d4341dbfb093f92314cbbd6f55e037f3c2c57bf753aee99fba488800694a2081ee9296c759280ba6ee56310d8f3b57
TLSH
T12F11CC4557F2024BF0DB0232DFC7A724055959281617C48E680C35B7612F310DA97FB9
MD5 SHA1 SHA512 TLSH

Submit Download

eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1404337215-1550464601-2805570857-1000\eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a
Size 1KB
SHA256 1e69fa10f8ee5edfd2fce13f9463c19becdd89544e7f74d7e030d28bb01bd04b
MD5 da86d462c3a79dd8e6cdbeeeb1b71ec2
SHA1 b9ba1f03bff53386fdc5ba52829c5740a388d936
SHA512 687d129a56d70ad6e98578db40db7ba6013408d748f102610bd8323378604b9abb61f3f39068fb95de4106455273bac4e8809e0792ad1538d24bc954fa002ee6
TLSH
T19C11A846F7138243F855B3749693941C29D26F265363E16C570641A47E1B76004F87F5
MD5 SHA1 SHA512 TLSH

Submit Download

eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1404337215-1550464601-2805570857-1000\eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a
Size 1KB
SHA256 e02c31c0c2ab7e6078d3bea56af606ef8c7b944130bfe029e42c77db08b5001a
MD5 a2c5b011ab086c8fe9810fd02e8b93e2
SHA1 59880bc60b24c56ccb0e060a25fae40ac9894895
SHA512 8aaf48695c2003d46124cfef001c2e6d533eb4b54c56b9ab5a522b3dc882a5d0fece4debfcbee369bb50b39041b1d9ffb37ed5e686e2d57d6d0848c4cfb04bc7
TLSH
T1A8119414779AC0DAFC16E330EE5B7C6801F6C620C963E6212F14E2F8334DA9084E4BE6
MD5 SHA1 SHA512 TLSH

Submit Download

eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1404337215-1550464601-2805570857-1000\eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a
Size 1KB
SHA256 3feb8000145a6b033742cba6aefc4da93658cf3ab3207d2e8dd9b1cd42b29285
MD5 8f99fce0b6ad22873bff1115ce5701ef
SHA1 8e1ba7f3b4e445aa93f6c1280ad4bf11d0cde984
SHA512 d18df4eb7c0165ec9b80749e3f805c909b1d018e169bfe4e3d0c5758f70fb9cacc2bc13b70da8e3f91bd7434ded634fba190b92f2d6f9044d1063fe3de6bd995
TLSH
T1C111A81F3BF305EDD406FA3D690971051DC70B5A9A64C6DE0E0819702FA355D0139B76
MD5 SHA1 SHA512 TLSH

Submit Download

eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1404337215-1550464601-2805570857-1000\eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a
Size 1KB
SHA256 f431e63b7b095f8bfd3e353f35385f8eec4a028ecd5fe412ebaefb8f0cc71c74
MD5 2c6afe3ff52714328cabd07b052163a2
SHA1 64e709249249a576fd795460e1f59ef9b7864997
SHA512 797c96a920ca178767a5bd8c7be9ea5845f9af3777e0d58d5acd88931ea409bc39663aab1275b7f7ac69d8cd55c7064cf7fdf19f997d9e0d744839c9d6681c0b
TLSH
T1DA11980ABD765257F87983B45A4F701E19E0DD1152AFC722D300046C6A2DDA857E0761
MD5 SHA1 SHA512 TLSH

Submit Download

eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1404337215-1550464601-2805570857-1000\eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a
Size 1KB
SHA256 c66521331364bd1b1465ec1fb5dfd53d9b54e29ade9b31d1f3c4ea9e234c5f4a
MD5 f2629afab8ca9358136b927bcc01e0cf
SHA1 6f4c25866d50bde2f44b4016f9e759b4e6d7011f
SHA512 79bcfcb66af261c15b1043d0eaf79c27ddeca8d8d117f87311cdbc15b5f5c3b91f4f43d7a54426562047a6cf82766fb33b040ce4df64fdc39b97577432cae6e6
TLSH
T155117E4B73F6078BE88863303887B92E4AE3C9B081B2C121FA8413B564170D0E268F21
MD5 SHA1 SHA512 TLSH

Submit Download

eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1404337215-1550464601-2805570857-1000\eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a
Size 1KB
SHA256 02c413d2e830b44096e524e0baee828a9128528286b8e02531337020a61462c2
MD5 06e658acba9bb90f9fc1f3f9b2e0c4db
SHA1 232504f237c76c8ed9f350d19552a1e9a1b91a0d
SHA512 b3ac1f3fe452aeb1c90e83bee6d0a68db94f9603bad161a4ca6dc3db385ca2db0dfe7dcd69b7c422d98d614d9932ed3f77fda5c5516fb6199eac5bcd6358d8e3
TLSH
T16511A523BAB22AD1FC2DE332918F1A46420AC4067333C117258580549F302D0D4DE372
MD5 SHA1 SHA512 TLSH

Submit Download

eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1404337215-1550464601-2805570857-1000\eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a
Size 1KB
SHA256 772cf5863e0ea68582675355d8f2719e01d3116442f4f29eb9750efa1332aabf
MD5 1e0cbe639a389558c5b54a0a789864ad
SHA1 e54abbfacf4784bd099ce08d1552f36662981c81
SHA512 adb7a1fad09a428f65430cb559eeec0e45de75729fb60d7c4cc0de4d2e975c4523fd955be8d5df36ce0d82a3aeb25303f487d345b0f652f43b2fddc1edce5ec8
TLSH
T15411C889FB31C101CEA583B1394FD72A1AC1CC1FC31786F5F603128A7A33AC19056761
MD5 SHA1 SHA512 TLSH

Submit Download

eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1404337215-1550464601-2805570857-1000\eff606c06dc1aec388d22994aeec3ad4_a138fda6-9c2c-4447-951e-b6e8ae1ea94a
Size 1KB
SHA256 18a343df91f596bfed765af00720e6172d0333ff8007845e2f80e24a3d974656
MD5 71d9a27ed44c80e9f31ed9e11441a2e6
SHA1 8476d1fb9e250f68c8469e8caf83bed66964f9c6
SHA512 34c72a865c94f5664e63b41ce12bc3d81bdd77aed7799cd9019d5d74f0a1e5175d742e946fccdacb5ebe588e663dfc8fe5489f7d049e2d7321fac6e5f3f8553a
TLSH
T1A311A8E1BAA30265E056B77418B38C1811C66E1CADAAC67B120955780A3F16084C4FE1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4324-0-0x000000000FE10000-0x000000000FE58000-memory.dmp

Download

memory/4324-110-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/4324-109-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/4324-108-0x00000000080A0000-0x0000000008106000-memory.dmp

Download

memory/4324-111-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/4324-112-0x00000000080A0000-0x0000000008106000-memory.dmp

Download

memory/4324-113-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/4324-115-0x000000000FE2E000-0x000000000FE2F000-memory.dmp

Download

memory/4324-114-0x000000000FE10000-0x000000000FE58000-memory.dmp

Download

memory/4324-117-0x000000000FE10000-0x000000000FE58000-memory.dmp

Download