Categories: SpyTrojan

UDS:Trojan-Spy.Win32.Panda.sb (file analysis)

The UDS:Trojan-Spy.Win32.Panda.sb is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What UDS:Trojan-Spy.Win32.Panda.sb virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
Yara rule detections observed from a process memory dump/dropped files/CAPE
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Deletes its original binary from disk
CAPE detected the ZeusPanda malware family
Collects information to fingerprint the system

How to determine UDS:Trojan-Spy.Win32.Panda.sb?


File Info:
name: 91BB1E6C58BFD6F74E10.mlwpath: /opt/CAPEv2/storage/binaries/77644cc37e18603604cc8c54d689d429bbbdacd7ec147b5d60a3d6f7e3ec4393crc32: B829E3E5md5: 91bb1e6c58bfd6f74e10f8c42d102511sha1: 25dfbcc4c36d21fd12f35c48d0864266c0195df6sha256: 77644cc37e18603604cc8c54d689d429bbbdacd7ec147b5d60a3d6f7e3ec4393sha512: a5404495df1e0d08a99ba09ff138d75c92bb5cd6fc22f8d484169b8a24be14db258434a240ab13438cda1c11aa2a1a8441ae72a4bafa1e9afcb01f1464fda167ssdeep: 3072:rgTrM273go6XPCHjvbBdIQTJG01dEac94TLT4JXkexh:rGblbnVljctype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T16EC39E53FAC744F8D66538709E5A7582F9F5EF08006A9A8783E05F879850A7CF72D2C2sha3_384: 53cc5717725fdc6527b9f49946e1e5fe121f0bb1d867e9092c1cc65f5e45f073db37eecd5fe346b56f90b6fa2a07f5d9ep_bytes: 51555733c9e8c7ecffffbf77010000bdtimestamp: 2016-12-21 08:24:07
Version Info:
0: [No Data]

UDS:Trojan-Spy.Win32.Panda.sb also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Panda.11620
MicroWorld-eScan	Gen:Heur.Mint.Dreidel.hqW@xWPvBcb
FireEye	Generic.mg.91bb1e6c58bfd6f7
ALYac	Gen:Heur.Mint.Dreidel.hqW@xWPvBcb
Cylance	Unsafe
Sangfor	Spyware.Win32.Zbot.8
K7AntiVirus	Spyware ( 004dcbc41 )
Alibaba	TrojanPSW:Win32/Dreidel.5f73cf2a
K7GW	Spyware ( 004dcbc41 )
Cybereason	malicious.c58bfd
BitDefenderTheta	Gen:NN.ZexaF.34160.hqW@aWPvBcb
Cyren	W32/Zbot.ZQIQ-6608
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Spy.Zbot.ACM
TrendMicro-HouseCall	TROJ_FRS.VSN1EE18
Paloalto	generic.ml
ClamAV	Win.Malware.Zbot-9813821-0
Kaspersky	UDS:Trojan-Spy.Win32.Panda.sb
BitDefender	Gen:Heur.Mint.Dreidel.hqW@xWPvBcb
NANO-Antivirus	Trojan.Win32.Panda.etdfgs
Avast	Win32:MalwareX-gen [Trj]
Tencent	Win32.Trojan.Crypt.Htcd
Ad-Aware	Gen:Heur.Mint.Dreidel.hqW@xWPvBcb
Emsisoft	Gen:Heur.Mint.Dreidel.hqW@xWPvBcb (B)
Comodo	Malware@#1yqlzltqpupo9
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_FRS.VSN1EE18
McAfee-GW-Edition	PWSZbot-FASJ!91BB1E6C58BF
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Zbot
GData	Gen:Heur.Mint.Dreidel.hqW@xWPvBcb
Jiangmin	TrojanSpy.Panda.f
Avira	TR/Crypt.XPACK.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.1E97C20
Arcabit	Trojan.Mint.Dreidel.E7C61E
Microsoft	PWS:Win32/Zbot.GOW!bit
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R359272
Acronis	suspicious
McAfee	PWSZbot-FASJ!91BB1E6C58BF
VBA32	BScope.TrojanSpy.Zbot
Malwarebytes	Malware.AI.1444329442
APEX	Malicious
Rising	Spyware.Zbot!8.16B (CLOUD)
Yandex	Trojan.GenAsa!vBrt6DhzJVQ
SentinelOne	Static AI – Malicious PE
eGambit	Trojan.Generic
Fortinet	W32/Generic.AP.1916D0!tr
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.300983.susgen