Procedure examples

Zeus Panda checks for the existence of a Registry key and if it contains certain values.

Zeus Panda obfuscates the macro commands in its initial payload.

Zeus Panda encrypts strings with XOR. Zeus Panda also encrypts all configuration and settings in AES and RC4.

Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.

Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.

Zeus Panda hooks processes by leveraging its own IAT hooked functions.

Zeus Panda checks for running processes on the victim’s machine.

Zeus Panda can launch remote scripts on the victim’s machine.

Zeus Panda uses PowerShell to download and execute the payload.

Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.

Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.

Zeus Panda uses HTTP for C2 communications.

Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.

Zeus Panda searches for specific directories on the victim’s machine.

Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.

Zeus Panda modifies several Registry keys under HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\ to disable phishing filters.

Zeus Panda can take screenshots of the victim’s machine.

Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.

Zeus Panda collects the current system time (UTC) and sends it back to the C2 server.

Zeus Panda decrypts strings in the code during the execution process.

Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.

Zeus Panda adds persistence by creating Registry Run keys.

Zeus Panda queries the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.