Loading malware…
Pandora is a Windows ransomware family that emerged in early 2022 and is associated with double-extortion operations against corporate networks. It encrypts files on compromised systems, appends a distinctive extension to encrypted data, drops ransom notes throughout affected directories, and threatens to publish stolen information if victims refuse to pay. Reporting has linked Pandora operationally and code-wise to Rook, and both are widely assessed as derived from leaked Babuk source code. Pandora has also been observed in activity attributed to DEV-0401, including intrusions exploiting unpatched internet-facing systems such as VMware Horizon instances exposed to Log4j-related vulnerabilities.
Technically, Pandora is a 64-bit Windows PE ransomware payload that uses heavy obfuscation and anti-analysis measures. Analyses describe modified UPX-based packing, encrypted strings, indirect or obfuscated function calls, control-flow flattening, opaque predicates, and other anti-reverse-engineering techniques. The malware impairs defensive visibility by patching AMSI and disabling ETW logging in memory, and it may use anti-debugging checks to hinder analysis. It also creates a mutex to enforce single-instance execution.
Before encryption, Pandora performs system and drive discovery, including enumeration of logical volumes and mounting of otherwise unmounted drives to expand encryption coverage. It deletes shadow copies, empties the recycle bin, adjusts shutdown behavior, and uses multithreading together with Windows I/O completion mechanisms to accelerate filesystem traversal and encryption. Pandora maintains exclusion lists for selected directories, filenames, and extensions to avoid destabilizing the operating system. It can terminate processes or use Windows Restart Manager APIs to unlock files held open by running applications.
Pandora uses embedded asymmetric cryptographic material and stores generated key material in the Windows Registry. It has been described as using RSA-based encryption functionality and statically linking the Mbed TLS library. Some reporting also notes use of DLL side-loading in Pandora-related execution chains and process injection into a newly spawned system process. Victimology includes high-profile organizations, with reporting indicating particular impact on corporate environments and overlap with automotive-sector targeting. Pandora is notable both for its extortion operations and for the sophistication of its packing, evasion, and anti-analysis implementation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Utilizes a known vulnerability (CPU-Z CVE-2017-15303) that allows it to read and write into physical memory and read CPU control registers to turn the DSE off. | On two occasions (in March and October 2020), we found a kernel rootkit that had been deployed. After analysis, it appears that this rootkit’s behavior is very similar to that of the NDISProxy driver and remote access trojan (RAT). We chose to call it “Pandora” based on the program database (PDB) path of the unpacked stage 2.
In February of 2022, DEV-0401 was observed deploying the Pandora ransomware family, primarily via unpatched VMware Horizon systems vulnerable to the Log4j 2 CVE-2021-44228 vulnerability.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The newly emerged Pandora ransomware that crowned the name is no exception. It steals data from the victim’s network, encrypts the victim’s files, and unleashes the stolen data if the victim opts not to pay.
Since around 2021, HUI Loader variants have been deployed in operations involving the ransomware families LockFile, AtomSilo, NightSky, LockBit 2.0, and Pandora.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
DEV-0401 differs from many of the attackers who rely on purchasing access to existing malware implants or exposed RDP to enter a network. Instead, the group heavily utilizes unpatched vulnerabilities to access networks, including vulnerabilities in Exchange, Manage Engine AdSelfService Plus, Confluence, and Log4j 2.
The content repeatedly describes malware and threat actors injecting shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, cmd.exe, lsass.exe, and browser processes.
GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process. Cardinal RAT injects into a newly spawned process created from a native Windows executable.
Pandora developer makes it very difficult for static analysis, its code uses indirect calls through registers rax, rdx, rbp , etc. Important strings such as Mutex name, Dll Name, PUBLIC KEY info, Ransom note, are already encrypted and decrypted when the malicious code executes.
all results show that this sample is packed by UPX ... the names of sections have been changed, not UPX0, UPX1, it changed to pppp and cccc. Additionally, the information behind the 3.00 UPX! strings were stripped by the attacker
The library modules used by Pandora are dynamically loaded on a per-use basis via the following APIs: LoadlibraryA GetProcAddress GetModuleHandleA.
The launcher starts by instantiating the CLoadInfo object... Directory to copy all files %PROGRAMDATA%\Test\ ... Name of the legitimate executable dlpumgr32.exe ... Lastly, the launcher starts a suspended process with the command line “C:\Windows\system32\svchost.exe -k LocalServices,”and injects the appropriate shellcode into it.
The content repeatedly describes malware and threat actors injecting shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, cmd.exe, lsass.exe, and browser processes.
GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process. Cardinal RAT injects into a newly spawned process created from a native Windows executable.
After setting these shutdown parameters, the malware empties the recycle bin via SHEmptyRecyclebinA API. Finally, the volume shadow copies are deleted by executing a string of commands via ShellExecuteA. It uses vssadmin to perform the task of deleting the shadow files.
Finally, it calls ShellExecuteW to launch a command for deleting all shadow copies: The command is: cmd.exe "/c vssadmin.exe delete shadows /all /quiet"
The version we found is slightly different — the driver isn’t digitally signed but instead utilizes a known exploit to bypass Windows Driver Signature Enforcement (DSE) protection and load the driver directly into the system.
it calls ShellExecuteW to launch a command for deleting all shadow copies: The command is: cmd.exe "/c vssadmin.exe delete shadows /all /quiet"
Initially, the ransomware creates a mutex... to make sure only one instance of the malware is running on the system.
By calling IsWow64Process , Pandora checks if its process is running under a 64-bit system. If it is, then it calls Wow64DisableWow64FsRedirection
The CreationTime, LastWriteTime, and LastAccessTime will be updated according to the C:\Windows\system32\kernel32.dll file and their file attributes will be set to “hidden” and “system”.
Registers WPF callback and filters incoming traffic with a predefined token... If the incoming traffic contains a token and is in the HTTP format, the backdoor will intercept the traffic and process the command.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, enumerating PIDs, checking for specific process names, or using APIs such as CreateToolhelp32Snapshot and commands such as tasklist and ps.
The main thread starts to enumerate the drives present on the system... After dumping the ransom note, the malware uses FindFirstFileW to open a handle to the files on the disk... Another worker thread can now call GetQueuedCompletionStatus to retrieve the absolute path of the target file to start encrypting the files.
Then it uses the function GetDriveTypeW to find drives with type DRIVE_NO_ROOT_DIR . Next Pandora calls the FindFirstVolumeW , GetVolumePathNamesForVolumeNameW , SetVolumeMountPointW , FindNextVolumeW functions to mount the drives.
As a prior step to the encryption process, the malware accesses directories in the network drives and dumps the ransom note (Restore_My_Files.txt).
Initially, the ransomware creates a mutex... to make sure only one instance of the malware is running on the system.
These components give the operator command-shell access, file management, keyboard and mouse control, network scanning, credential dumping, keylogging, browser password theft, email collection and remote access. They also installed Pandora remote-control agents and connected directly to email servers using account credentials.
4.7. Empty all Recycle Bins on all drives For empty all recycle bins, Pandora calls the function SHEmptyRecycleBinA
### What happened? #### !!!Your files are encrypted!!! *All your files are protected by strong encryption with RSA-2048.*
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a ransomware variant developed from leaked Babuk source code.
Pandora is a malware sample detected in the analysis, but specific details are not provided in the content.
Multistage kernel-mode rootkit/backdoor included in APT27's toolset for stealth and persistence.
Pandora is a ransomware family cited in connection with HUI Loader-supported operations and BRONZE STARLIGHT-linked activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.