Overview

overview

10

Static

static

d8775fce1a...3e.exe

windows7_x64

10

d8775fce1a...3e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8775fce1a11f8a891675ab591170aba7338ce17340de24332e146267e3f4f3e

  • Size

    2.3MB

  • Sample

    220620-v6kfcagdep

  • MD5

    d39b445051e7117037ab3fa5cfb74c68

  • SHA1

    5e72553b05b9d193849ea7eac6b264fdc7501108

  • SHA256

    d8775fce1a11f8a891675ab591170aba7338ce17340de24332e146267e3f4f3e

  • SHA512

    6459a411fd421f6b2d4c6ac2338dda3b919cef32fb9610581525b74f1cef46da37ab497bee16b48e6933721cb84de214ad020f3c419703087303db808189e05f

Score
10/10
bandookpersistencerattrojanupx

Malware Config

Targets

    • Target

      d8775fce1a11f8a891675ab591170aba7338ce17340de24332e146267e3f4f3e

    • Size

      2.3MB

    • MD5

      d39b445051e7117037ab3fa5cfb74c68

    • SHA1

      5e72553b05b9d193849ea7eac6b264fdc7501108

    • SHA256

      d8775fce1a11f8a891675ab591170aba7338ce17340de24332e146267e3f4f3e

    • SHA512

      6459a411fd421f6b2d4c6ac2338dda3b919cef32fb9610581525b74f1cef46da37ab497bee16b48e6933721cb84de214ad020f3c419703087303db808189e05f

    Score
    10/10
    bandookpersistencerattrojanupx

    • Bandook Payload

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks