Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<Full path to file>' = '<Full path to file>:*:Enabled:Panda Cloud Repo...
Modifies file system:
Creates the following files:
- %TEMP%\<File name>\<File name>.log
- %TEMP%\<File name>\List\CheckUrl.txt
- %TEMP%\<File name>\EventLog\Application.evt
- %TEMP%\<File name>\EventLog\System.evt
- %TEMP%\<File name>\Reg\Services.reg
Network activity:
Connects to:
- 'pc#######rt.pandasecurity.com':443
- 'pa#######ingcsm.centrastage.com':443
- 'pa######.centrastage.net':443
- 'sm.####asecurity.com':443
- 'st#######s.pandasoftware.com':80
- 'im#.###dasecurity.com':443
- 'ia##.org':80
- 'pr#####.pandasoftware.com':80
- 'ca####.#andasecurity.com':80
- 'ca###.#andasoftware.com':80
- 'mp########async.pandasecurity.com':80
- 'mp########sync.pandasecurity.com':443
- 'mp########sync.pandasecurity.com':80
- 'mp########inst.pandasecurity.com':80
- 'mp########inst.pandasecurity.com':443
- 'he######.pandasoftware.com':80
- 'ne#####te2.intego.com':443
- 'ne#####te2.intego.com':80
- 'in####download.com':80
- 'in##go.com':80
- 'pc#######.#ownloads.pandasecurity.com':80
- 'pc#######.updates.pandasecurity.com':80
- 'en########.updates.pandasoftware.com':80
- 'ac#.###dasoftware.com':80
- 'ma########tection.pandasecurity.com':443
- 'pa#####oudsecurity.com':443
- 're######1.pand.ctmail.com':80
- 'do####ad.ctmail.com':80
TCP:
HTTP GET requests:
- http://ac#.###dasoftware.com/member/installers/
- http://st#######s.pandasoftware.com/
- http://www.ia##.org/ via ia##.org
- http://pr#####.pandasoftware.com/connectiontest.html
- http://pr#####.pandasoftware.com/
- http://ca####.#andasecurity.com/
- http://ca###.#andasoftware.com/
- http://mp########async.pandasecurity.com/Agents/Service.svc
- http://mp########sync.pandasecurity.com/Agents/Service.svc
- http://mp########inst.pandasecurity.com/Agents/Service.svc
- http://he######.pandasoftware.com/getqesd.aspx
- http://he######.pandasoftware.com/getqesi.aspx
- http://www.ne#####te2.intego.com/ via ne#####te2.intego.com
- http://www.in####download.com/ via in####download.com
- http://www.in##go.com/ via in##go.com
- http://pc#######.#ownloads.pandasecurity.com/nano/pavsignano/nano_1/
- http://pc#######.updates.pandasecurity.com/updates/nanoupdate.phtml
- http://en########.updates.pandasoftware.com/updates_ent/
- http://en########.updates.pandasoftware.com/pcop/uacat/
- http://ac#.###dasoftware.com/pcop/uacat
- http://ac#.###dasoftware.com/sigfiles
- http://ac#.###dasoftware.com/free/
- http://en########.updates.pandasoftware.com/pcop/pavsig/
- http://ac#.###dasoftware.com/member/uninstallers/
- http://re######1.pand.ctmail.com/
- http://do####ad.ctmail.com/
UDP:
- DNS ASK pc#######rt.pandasecurity.com
- DNS ASK pa#######ingcsm.centrastage.com
- DNS ASK pa######.centrastage.net
- DNS ASK sm.####asecurity.com
- DNS ASK st#######s.pandasoftware.com
- DNS ASK im#.###dasecurity.com
- DNS ASK www.ia##.org
- DNS ASK pr#####.pandasoftware.com
- DNS ASK ca####.#andasecurity.com
- DNS ASK ca###.#andasoftware.com
- DNS ASK mp########async.pandasecurity.com
- DNS ASK re######1.pand.ctmail.com
- DNS ASK mp########sync.pandasecurity.com
- DNS ASK he######.pandasoftware.com
- DNS ASK www.ne#####te2.intego.com
- DNS ASK www.in####download.com
- DNS ASK www.in##go.com
- DNS ASK pc#######.#ownloads.pandasecurity.com
- DNS ASK pc#######.updates.pandasecurity.com
- DNS ASK en########.updates.pandasoftware.com
- DNS ASK ac#.###dasoftware.com
- DNS ASK ma########tection.pandasecurity.com
- DNS ASK www.pa#####oudsecurity.com
- DNS ASK mp########inst.pandasecurity.com
- DNS ASK do####ad.ctmail.com
