Extracted

• • Target

    e5e4272f9a129cfdd3f7ec1a0c0adad1791b6e6c9e16e780a4d0e15e907b0a50

  • Size

    95KB

  • MD5

    c1ff10dc99cf07334206127b92f13786

  • SHA1

    fc64ce7c1fd8dd6bb03d047a57bc15a9d649eaae

  • SHA256

    e5e4272f9a129cfdd3f7ec1a0c0adad1791b6e6c9e16e780a4d0e15e907b0a50

  • SHA512

    3a43647e8113d51943e8d7194d7924467f052adb8b4a1f395ccf3ca95557cb9a8b28e978a328b950ba23d212157f58eab2ce800adcce5e97618514bd539aced9

  • SSDEEP

    1536:fSd5KYWfdbEIUx2eH4Ondcv0/h1UfZRorH5Tjbnk1ZntKZm/bJURNbw+b:qd5KYWfdbEdxTHnUWh1UfZRor5P+FMoa

  Score

  10^/10

  bandookpersistencerattrojanupx

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2