PandaBanker
Aliases: ZeusPanda
- First seen
- 2016-02-01 00:00:00
- Malware type
- trojan, credential-stealer, botnet
- Family
- Malware family
- Last IoC activity
- 2026-07-11 01:23:21
- Profile updated
- 2026-07-07 12:55:50
Targeted industries: financial-services
Context
According to Arbor, Forcepoint and Proofpoint, Panda is a variant of the well-known Zeus banking trojan(*). Fox IT discovered it in February 2016. This banking trojan uses the infamous ATS (Automatic Transfer System/Scripts) to automate online bank portal actions. The baseconfig (c2, crypto material, botnet name, version) is embedded in the malware itself. It then obtains a dynamic config from the c2, with further information about how to grab the webinjects and additional modules, such as vnc, backsocks and grabber. Panda does have some DGA implemented, but according to Arbor, a bug prevents it from using it.
Detection coverage
- 2 YARA rules
Detection rules
- CAPE_Zeuspanda (yara-rule)
- MALPEDIA_Win_Pandabanker_Auto (yara-rule)
Reports & references
- slideshare.net — Cb19 Cyber Threat Landscape In Japan Revealing Threat In The Shadow By Chi En Shen Ashley Oleg Bondarenko (report)
- proofpoint.com — Holiday Lull Not So Much (report)
- proofpoint.com — Threat Actor Profile Ta544 Targets Geographies Italy Japan Range Malware (report)
- Trend Micro — Ssl Tls Technical Brief (report)
- f5.com — Banking Trojans A Reference Guide To The Malware Family Tree (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Pandabanker (report)
- youtube.com — Watch (report)
- f5.com — Panda Malware Broadens Targets To Cryptocurrency Exchanges And Social Media (report)
- vkremez.com — Lets Learn Dissecting Panda Banker (report)
- spamhaus.org — 771 (report)
- Cisco Talos — Zeus Panda Campaign (report)
- proofpoint.com — Zeus Panda Banking Trojan Targets Online Holiday Shoppers (report)
- cyber.wtf — Zeus Panda Webinjects A Case Study (report)
- arbornetworks.com — Panda Banker Zeros In On Japanese Targets (report)
- cyberwtf.files.wordpress.com — Panda Whitepaper (report)
- medium.com — Panda Banker Analysis Part 1 D08B3A855847 (report)
- vkremez.com — Lets Learn Dissect Panda Banking (report)
- cyber.wtf — Zeus Panda Webinjects Dont Trust Your Eyes (report)
- github.com — Pandabanker (report)