General

  • Target

    TIKET DE ACUSE DE PAGO 21-09-2022_B.rar

  • Size

    2.0MB

  • Sample

    220921-tbsmssgfb4

  • MD5

    9c0efbd3101377c405ff8c5a76d29634

  • SHA1

    619dc7c6fe2e41db1f7f2e39c3079dd0a0d61113

  • SHA256

    873e6c8a049b8e387f1246b9f0a15891341ba4320998e56cacdb851c0e14cacf

  • SHA512

    d0d468bcb65e1fe7578a24cab933120943df65336f0015fdd84eb13f36fa0d76322ea6d89b04a07d3dc188638bcb467ed5466c2f67f29200a90a1eb173fc7e55

  • SSDEEP

    49152:U+ctu8Fq+tF5HoeF37udvVnYg3lvxne66L+t6xogMe3roQc+S5:U+dCftXvF3MRrvUL3xVMezS5

Score
10/10

Malware Config

Targets

    • Target

      TIKET DE ACUSE DE PAGO 21-09-2022_B.exe

    • Size

      3.0MB

    • MD5

      a986715bc03da3613fa1e63e3a2a38f6

    • SHA1

      75c1c48a018cc8c63f154da2d81f4949beb30bb3

    • SHA256

      83c24c9bca7a2e2ca9b00bfd5b2b04c464d90ba24d23f0d708ba56578ca8e3b7

    • SHA512

      161f2c91ee9ddb203904b94a7087c4e1193ded81cee77fa09e66fe6b1ee3beca188b214efb53ffb6a62f51e8cf452b185ef35169ea6a8335b94c6bf28a90a6ad

    • SSDEEP

      49152:BUUcMvybmbLj+JrHJk3OVcRDjHrCTny8ciBMsRl1djm:BF

    Score
    10/10
    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      msvfw32 - copia (4).dll

    • Size

      148KB

    • MD5

      f3354260c4b1383c586da9affde33d6b

    • SHA1

      2b911b3c59cc975fa081b88d4de21d345841dfb5

    • SHA256

      7e09b985d0ce2e6cab125bfb88ea3f3f85e9de065bcf2c140c7ba6ca82ad5dc0

    • SHA512

      9adf858c6d5f1601600294fb4c982ef0aa95cd386a98e17fb674619b2d38d330bcf46a27005e51ed0a967ec64e60bc86c3c3c40edaf8770fe8e2efdab83eda0e

    • SSDEEP

      3072:myAoMfEgYZciuGjmtyOpDHn4RO9rK47Xx+9O3QIPf64gDyyJ:Sbf8u67074Rerv7Xx+9OAIcDy

    Score
    1/10

MITRE ATT&CK Matrix

Tasks