Extracted

• • Target

    C36897E9150F3FCDBA12C6076726A645.exe

  • Size

    1.4MB

  • MD5

    c36897e9150f3fcdba12c6076726a645

  • SHA1

    dbd4dbfe4dabf06535353454ad1d9596f97de8b9

  • SHA256

    b079f2c81638d23c59c0c04c9e2b6caf02e8bac37746d1cded77b4638bd025be

  • SHA512

    0c7dde683eec79fac2e50cd33e7eb47f26e313d4dd4ebec04c79cb0a01ae15ce3cc25972f61ef187b19fe69dd8f9f903db623f1c58b739b9e036fc6ff4478078

  Score

  10^/10

  bandookpersistencerattrojanupx

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2