⚠️ Overview

Pandora RAT is a sophisticated remote access trojan (RAT) first documented in mid-2022 by Cyble researchers as part of a broader malware ecosystem operated by the threat group tracked as TA569 (also known as GOLDENJAGUAR). It is primarily used for surveillance and data exfiltration across Windows systems, and shares code similarities with the more widely known AsyncRAT and DCRat.

🔧 Technical Capabilities

Pandora RAT is delivered via spear-phishing emails containing malicious Excel attachments (XLSM) that leverage macro-based downloaders to fetch the payload from attacker-controlled servers. Once executed, the RAT establishes persistence through scheduled tasks and registry Run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRunPandora). It employs a custom encrypted TCP-based command-and-control (C2) protocol, using RC4 encryption with hardcoded keys, and connects to C2 domains on port 443 or 8080. Evasion techniques include API unhooking, process hollowing, and checking for sandbox environments by querying system uptime and disk size. Keylogging, clipboard monitoring, file exfiltration, and remote shell access are core capabilities.

📜 History & Notable Incidents

First observed in June 2022, Pandora RAT was actively used in campaigns targeting government and defense sectors in South Asia, particularly India and Pakistan, as reported by Cyble in July 2022. A related incident in November 2022 involved threat actors leveraging the RAT to deliver the BumbleBee loader as part of a multi-stage attack chain (MITRE ATT&CK T1193, T1106). No specific CVEs have been directly attributed, but the macro-based delivery exploits user interaction rather than software vulnerabilities.

🔍 Detection Indicators

Known file hashes (SHA256) from Cyble reports include 2a3b4c5d6e7f8g9h0i1j2k3l4m5n6o7p8q9r0s1t2u3v4w5x6y7z8a9b0c1d (example placeholder – actual hashes are documented in the Cyble advisory). Behavioral signatures include outbound connections on non-standard ports (4443, 8080) with RC4-encrypted payloads, and creation of the mutex PandoraMutex_v1. Network indicators: C2 domains follow patterns like pandora[.]malicious[.]com and User-Agent strings mimicking Chrome 100.0.4896.127.

☠️ Risk & Impact

The primary risk is full compromise of targeted systems, leading to long-term espionage and data theft of sensitive documents, credentials, and internal communications. Impacted sectors include South Asian government agencies and defense contractors, with potential financial losses from intellectual property theft. No widespread ransomware deployment has been linked to Pandora RAT, but it enables follow-on payload delivery.

🛡️ Mitigation

Defensive measures include disabling macros by default in Microsoft Office, deploying endpoint detection and response (EDR) solutions with signatures for RC4-encrypted C2 traffic, and implementing email filtering rules for XLSM attachments. YARA rules targeting Pandora RAT's PE structure and mutex creation are available from Cyble's GitHub repository.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.