Overview

overview

10

Static

static

PAGO AL IN..._B.exe

windows7-x64

10

PAGO AL IN..._B.exe

windows10-2004-x64

10

PAGO AL IN...6).dll

windows7-x64

1

PAGO AL IN...6).dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bandook.zip

  • Size

    2.1MB

  • Sample

    220921-1nx7dahba2

  • MD5

    affe87fd7a87daceb174dca7ac60357c

  • SHA1

    7a84a21e7e74c2970858d091c2c70610ced1e9a4

  • SHA256

    a374e41c655e55e462fa0ec239301867759a9bb8a622bb7f07e2bde0ad2dc394

  • SHA512

    00e14bf4153753c5e74e8edfa9b3f0d6531c7e15d63f1415e2aef47ae59b36d6c043463b08c57dd193017256b476c36362bf1ae00a846e9bcedc9ac8900f25a2

  • SSDEEP

    49152:fHr3rd7O+IJiz/s+LR/lBdlsV9yTnquZdYdrr4iusiOaDnB/Xfo:fHrbdKCsAR/BOVCAxGNXfo

Score
10/10
bandookpersistencerattrojanupx

Malware Config

Targets

    • Target

      PAGO AL INSTANTE LBTR 21-09-2022_B(1)/PAGO AL INSTANTE LBTR 21-09-2022_B.exe

    • Size

      3.0MB

    • MD5

      a986715bc03da3613fa1e63e3a2a38f6

    • SHA1

      75c1c48a018cc8c63f154da2d81f4949beb30bb3

    • SHA256

      83c24c9bca7a2e2ca9b00bfd5b2b04c464d90ba24d23f0d708ba56578ca8e3b7

    • SHA512

      161f2c91ee9ddb203904b94a7087c4e1193ded81cee77fa09e66fe6b1ee3beca188b214efb53ffb6a62f51e8cf452b185ef35169ea6a8335b94c6bf28a90a6ad

    • SSDEEP

      49152:BUUcMvybmbLj+JrHJk3OVcRDjHrCTny8ciBMsRl1djm:BF

    Score
    10/10
    bandookpersistencerattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

    • Target

      PAGO AL INSTANTE LBTR 21-09-2022_B(1)/msvfw32 - copia (6).dll

    • Size

      148KB

    • MD5

      f3354260c4b1383c586da9affde33d6b

    • SHA1

      2b911b3c59cc975fa081b88d4de21d345841dfb5

    • SHA256

      7e09b985d0ce2e6cab125bfb88ea3f3f85e9de065bcf2c140c7ba6ca82ad5dc0

    • SHA512

      9adf858c6d5f1601600294fb4c982ef0aa95cd386a98e17fb674619b2d38d330bcf46a27005e51ed0a967ec64e60bc86c3c3c40edaf8770fe8e2efdab83eda0e

    • SSDEEP

      3072:myAoMfEgYZciuGjmtyOpDHn4RO9rK47Xx+9O3QIPf64gDyyJ:Sbf8u67074Rerv7Xx+9OAIcDy

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks