8-16-2018: Panda Banker from GrandSoft->Smoke

Panda: 6e131928aee8964f5226cbe0a030f6a553f2a05dd21053e7b29663dbf28b016e

{
"botnet":	"2.6.9",
"check_config":	327685,
"send_report":	327685,
"check_update":	327685,
"url_config":	"https://uiaoduiiej.chimkent.su/5fewucaopezanxenuzebu.dat",
"url_webinjects":	"https://uiaoduiiej.chimkent.su/webinjects.dat",
"url_update":	"https://uiaoduiiej.chimkent.su/5fewucaopezanxenuzebu.exe",
"url_plugin_webinject32":	"https://uiaoduiiej.chimkent.su/webinject32.bin",
"url_plugin_webinject64":	"https://uiaoduiiej.chimkent.su/webinject64.bin",
"remove_csp":	1,
"inject_vnc":	1,
"url_plugin_vnc32":	"https://uiaoduiiej.chimkent.su/vnc32.bin",
"url_plugin_vnc64":	"https://uiaoduiiej.chimkent.su/vnc64.bin",
"url_plugin_vnc_backserver":	"nityYUQPeUwsKYfNAKh7c9O8lCQ=",
"url_plugin_backsocks":	"https://uiaoduiiej.chimkent.su/backsocks.bin",
"url_plugin_backsocks_backserver":	"nityYUQPeUwsKYfNAKh7c9O8lCQ=",
"url_plugin_grabber":	"https://uiaoduiiej.chimkent.su/grabber.bin",
"grabber_pause":	1,
"grab_softlist":	1,
"grab_pass":	1,
"grab_form":	1,
"grab_cert":	1,
"grab_cookie":	1,
"grab_del_cookie":	0,
"grab_del_cache":	0,
"url_plugin_keylogger":	"https://uiaoduiiej.chimkent.su/keylogger.bin",
"keylog_process":	"ZmlyZWZveC5leGUAY2hyb21lLmV4ZQBpZXhwbG9yZS5leGUAb3BlcmEuZXhlAAA=",
"screen_process":	"cHV0dHkuZXhlAAA=",
"reserved":	"JxZpa8bZHbYkIIvhyEd1cVZ/nS6URxD5wnvrDNiAjyi3xnWW8S8q9f/0ap+7kLHnW4XhNudnwRRizwE="
}



"BotInfo":	{
"systime":	UNIX,
"process":	"svchost.exe",
"user":	“MACHINE”,
"id":	“BOT”,
"botnet":	"2.6.9",
"version":	"2.6.10",
"os":	{
"version":	“ID”,
"sp":	1,
"build":	INT,
"bit":	INT,
"server":	0,
"lang":	INT,
"explorer":	INT
}
}