Extracted

• • Target

    b9ca91d4651446f6cd6283af2acc1a14c73e9abc746323cd684b8f208fc42b8f

  • Size

    1.9MB

  • MD5

    3f57988fa30c927eaec2cd3ea07e1345

  • SHA1

    02ada56f35fcf701b5f93e4133caef910d51f6b7

  • SHA256

    b9ca91d4651446f6cd6283af2acc1a14c73e9abc746323cd684b8f208fc42b8f

  • SHA512

    686e91ee0db732d984b48a4d44fbe4a4d94022b80420f67a89bd560fd9ab6d1dbfebe0f930c7c5b3590aac8c8d90c548f5764fbe8beda2cead1fe2978a7db9d1

  • SSDEEP

    24576:eFj/+UN64hNf4nQbaOFjA1hVaZFdIsfy+aOEDlh6Nt3W2cp+jpAHsqTxRTr9D2yb:X

  Score

  10^/10

  bandookpersistencerattrojan

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2