Extracted

• • Target

    afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

  • Size

    1002KB

  • MD5

    66e7fff4370f216117c1ab836b43f320

  • SHA1

    68571b2e855fcaf068f73730ac10675128b4f217

  • SHA256

    afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

  • SHA512

    fe7f11cd216d8be8833f7d99686e94e9d6134772cab878cdef756a2c199fff8f26d88efa108dbc9356ef330a6eeff57a9c90cef80b94da59a16d3210b9ab926c

  • SSDEEP

    24576:dlFlrWrVnrfUEEAXU7PcOeLqkVsD7s/Xl2y:dlKBfTSPcOeLtsnsvl1

  Score

  10^/10

  bandookpersistencerattrojan

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2