Pandemiya

Pandemiya is a spyware program used for collecting information from either random individuals or specialized targets, with advanced features for guaranteeing its persistence and compromising any local Web-browsing activities. Because Pandemiya is rented out to third parties, its distribution methods may include diverse delivery strategies although malware analysts only can confirm Pandemiya using drive-by-downloads via website-hosted exploit kits. Removing Pandemiya necessitates significant Registry changes and should be done through specialized anti-malware products when such are available.

The Newest Cyber-Spy Selling Itself at a High Price

The lucrative nature of spyware development isn't solely about collecting profitable information; it also may include reaping financial rewards from other con artists. Using the same 'for rent' business model as Zeus, Pandemiya is sold on a temporary usage basis for prices starting at over one thousand USD, up to two thousand for its full, modular package. In addition to its baseline functions, Pandemiya may use easily-added DLL modules to expand its feature set. Examples of these optional extras include a plugin for distributing Pandemiya on Facebook pages and one that compromises FTP accounts with the assistance of an iFrame infection.

However, Pandemiya has seen major headlines from its core features, which cause some sources to speculate that Pandemiya may supplant the highly-popular, often-imitated Keylogger Zeus as the 'default' multi-purpose spyware of choice. Malware experts and other sources in the industry confirmed that Pandemiya's code, seemingly built up over a year of independent development, lacks any direct derivatives from Zeus, despite showing identical goals in its attacks. Some of Pandemiya's most meaningful default characteristics may include:

• Pandemiya may auto-inject itself into every new memory process, including re-injecting itself, as needed.
• Pandemiya may encrypt its network communication to prevent its detection by common threat detection technology.
• Pandemiya may inject compromised HTML into at least three, separate brands of Web browsers. Pandemiya also may collect text-based form input from these same browsers. Common uses for these attacks include redirecting a victim to a fake bank login page and then gathering any information entered.

Taking the Pandemonium out of Dealing with Pandemiya

In addition to taking steps against being identified by security industry analysts or removed by its victims, Pandemiya also includes default features clearly meant to guard against unaffiliated third parties hijacking its components. The effort put into its self-preservation, and substantial, individualized development makes it likely that Pandemiya's developers intend to make use of this spyware kit for months or even years to come. Social network users should be aware of common baiting tactics used to install Trojans, such as corrupted image links, although Pandemiya's distribution model could see new changes with each new con artist renting its services.

Deleting Pandemiya requires significant changes to the Registry, including entries associated with Windows security features. Use your anti-malware products to make these changes and prevent Pandemiya from starting automatically. Then reboot your computer and launch an additional scan for removing Pandemiya's files, which include some randomized file names. Pandemiya's timely deletion can prevent victims from suffering losses of bank account passwords and other, equally sensitive data.

Technical Details