ToxicPandaMalware
ToxicPanda is an Android banking RAT first identified by Cleafy in October 2024. It shows similarity to the TgToxic campaign, but appears to be a new development rather than a derivative. The threat actors are likely Chinese speakers. ToxicPanda initially made use of hardcoded C2 domains only, but started to incorporate a DGA in late 2024.From MISP Galaxy
Last reported 1 month ago, by Silent Push3 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1213.003Code Repositories
“The leak included databases for Geedge's Jira and Confluence portals, but also all its Git source code repositories, containing commit history going back to November 2024.”
- T1213.005Messaging Applications
“Named Manic, the trojan can target Ukrainian banks, government agencies, identity services, and local messaging applications.”
- T1505.003Web Shell
“Clop's new custom web shell: ReliaQuest's John Dilgen and Connor Short have published a report on Clop's new mass exploitation campaign targeting PTC Windchill servers and the new custom web shell they've been deploying for initial access.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall“ToxicPanda 2.0: ToxicPanda, an Android banking trojan spotted in 2024, has now reached version 2.0.”
-
“Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friend“ToxicPanda banking trojan matures into enterprise threat”
-
Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps“Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps”
Indicators in its reports
named in the reports above- 9f1f11a708d393e0…06f18ffcc507in 1 report
- 2915b3f8b703eb744fc54c81f4a9c67fin 1 report
- w32.9f1f11a708-100.sbx[.]tgin 1 report
- 9896a6fcb9bb5ac1…66decd6a4a7fin 1 report
- 38de5b216c33833af710e88f7f64fc98in 1 report
- 38d053135ddceaef…eecec4ba8f55in 1 report
- 41444d7018601b599beac0c60ed1bf83in 1 report
- w32.38d053135d-95.sbx[.]tgin 1 report
- c4dd71e347a076ba…942ba2ab16b2in 1 report
- 9a47c4d379998ade2f8f99e23a630c06in 1 report
- w32.c4dd71e347-95.sbx[.]tgin 1 report
- a31f222fc283227f…e110308dbf91in 1 report
- 7bdbd180c081fa63ca94f9c22c457376in 1 report
- 95.sbx[.]tgin 1 report
- e7e784cae8d37f12…4f4e80933c47in 1 report
- a4480423617d0b0d3b38c8471cbf594cin 1 report
Copy these 16 indicators · defanged
Thanks — we review every report.