Overview

overview

10

Static

static

afebfd81e9...34.exe

windows7-x64

10

afebfd81e9...34.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

  • Size

    1002KB

  • Sample

    221002-2rhfrseae3

  • MD5

    66e7fff4370f216117c1ab836b43f320

  • SHA1

    68571b2e855fcaf068f73730ac10675128b4f217

  • SHA256

    afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

  • SHA512

    fe7f11cd216d8be8833f7d99686e94e9d6134772cab878cdef756a2c199fff8f26d88efa108dbc9356ef330a6eeff57a9c90cef80b94da59a16d3210b9ab926c

  • SSDEEP

    24576:dlFlrWrVnrfUEEAXU7PcOeLqkVsD7s/Xl2y:dlKBfTSPcOeLtsnsvl1

Score
10/10
bandookpersistencerattrojan

Malware Config

Extracted

Family

bandook

C2

192.168.31.1

Targets

    • Target

      afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

    • Size

      1002KB

    • MD5

      66e7fff4370f216117c1ab836b43f320

    • SHA1

      68571b2e855fcaf068f73730ac10675128b4f217

    • SHA256

      afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

    • SHA512

      fe7f11cd216d8be8833f7d99686e94e9d6134772cab878cdef756a2c199fff8f26d88efa108dbc9356ef330a6eeff57a9c90cef80b94da59a16d3210b9ab926c

    • SSDEEP

      24576:dlFlrWrVnrfUEEAXU7PcOeLqkVsD7s/Xl2y:dlKBfTSPcOeLtsnsvl1

    Score
    10/10
    bandookpersistencerattrojan

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks