bandook | fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57 | Triage

Resubmissions

24-03-2022 12:21

220324-pjqqysghd3 10

16-07-2021 18:28

210716-3mtspqxy36 3

Sharing

General

Target

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57
Size

788KB
MD5

e2bcd26465f9715da2789febce3bedf7
SHA1

b3bd4d0c84d0751d88eb0343b8e194e499894a98
SHA256

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57
SHA512

17f6e5ebe109c652a0dce05de7ada1a0e3811f5558cf084398ece367a82f55fe1fd30797e20434db26a7d4245133e674db928c134c80f6e3297974f291c77219
SSDEEP

12288:GYmQItnY4J34fpOO5c5VDp/2CjyqGERs0Fy9XbhNFLOhKja/hB0MysG2nU:GYrItnzVgpmpvyqGERs0FWQKjOhB0H

Score

10^/10

bandook

Malware Config

Signatures

Bandook Payload 1 IoCs

Processes:

resource yara_rule

sample family_bandook
Bandook family
bandook

Files

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 536KB - Virtual size: 535KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 10.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ