CrowdStrike Putter Panda

Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.

An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).

4H RAT has the capability to obtain a listing of running processes (including loaded modules).

4H RAT has the capability to create a remote shell.

httpclient opens cmd.exe on the victim.

pngdowner deletes content from C2 communications that was saved to the user's temporary directory.

3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files.

3PARA RAT uses HTTP for command and control.

4H RAT uses HTTP for command and control.

pngdowner uses HTTP for command and control.

httpclient uses HTTP for command and control.

4H RAT sends an OS version identifier in its beacons.

3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.

4H RAT has the capability to obtain file and directory listings.

A dropper used by Putter Panda installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.

If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.

httpclient encrypts C2 content with XOR using a single byte, 0x12.

4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.

3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS. 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails

Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).