Pandex

Overview

Trojan:Win32/Pandex (often an alias or component of the massive **Cutwail** botnet) is a highly prevalent, persistent trojan whose primary objective is to infect endpoints, enroll them into a global botnet, and utilize their network resources to send millions of malicious spam emails (malspam). These spam campaigns are the primary distribution mechanism for other severe malware, including banking trojans (like Zeus or Emotet) and ransomware.

Understanding the Pandex (Cutwail) Botnet
To an end-user, a Pandex infection is largely invisible, although they may experience slowed internet speeds due to the background spam engine. For a security analyst, Pandex represents a severe compromise of network integrity. An infected endpoint actively attacks other organizations by blasting out phishing emails, which will quickly result in the corporate IP address being blacklisted by major spam databases (e.g., Spamhaus), disrupting legitimate corporate communications.

Execution and Spam Engine Mechanics
Pandex is typically distributed via exploit kits (`T1189`) or as a secondary payload dropped by another trojan. Upon execution, it employs sophisticated rootkit techniques to hide its presence. It injects its malicious code into legitimate system processes like `svchost.exe` or `explorer.exe` (`T1055`) to evade detection and mask its network activity. It establishes persistence via hidden Registry keys or Scheduled Tasks (`T1053.005`). Once established, it connects to a Command and Control (C2) server (`T1071.001`) to receive spam templates and target email lists. It then utilizes its own built-in SMTP engine (`T1534`) to blast thousands of spam emails directly from the infected endpoint, bypassing the corporate mail server.

Indicators of Compromise & Impact
The primary impact is the blacklisting of the corporate IP address and participation in global cybercrime. The most glaring network IoC is a massive, sustained spike in outbound SMTP traffic (Port 25 or 587) originating from an endpoint that is *not* an authorized mail server, attempting to connect directly to external MX records. Host-based IoCs include EDR alerts for process injection into `svchost.exe` and anomalous DNS queries for known spam tracking domains.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_PANDEX_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pandex"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "pandex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Pandex (Ransomware) Execution & Triage
id: 9bc0bf90-62d8-52d6-a2fd-beb02a85503a
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Pandex malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/pandex
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1562_001
- attack.t1534
- attack.t1055
- attack.t1071_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_PANDEX_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pandex tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "pandex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network to halt the spam engine and prevent further damage to the corporate IP reputation.
2. Verify your enterprise firewall is strictly blocking outbound Port 25 traffic from all endpoints except authorized Exchange/Mail servers.
3. Use an enterprise EDR solution or specialized rootkit removal tool to locate and terminate the injected Pandex processes.
4. Check global spam blacklists (e.g., MXToolBox, Spamhaus) to see if the corporate IP has been blacklisted, and begin the delisting process.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the endpoint is 'clean' just because it isn't encrypted by ransomware; acting as a spam node is a critical security breach.
2. Avoid relying solely on local antivirus scans; the rootkit techniques employed by Pandex/Cutwail often require a complete OS reinstall to guarantee removal.

References & External Analysis

• Search "pandex" on VirusTotal (External Analysis)
• Search "pandex" on Any.Run (Sandbox Sandbox)
• Search "pandex" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Minerbot
• Cleaman
• Typic
• Utoti
• Qdownb
• Cmy3U
• Zacom
• Krakencryptor

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/pandex.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.