Extracted

• • Target

    58f66b4b4353b69aa0b43f778d88c0d12fa95e048f00a28d5c0d26f1cdc9e799

  • Size

    1.3MB

  • MD5

    d72b647dc6b8a1b387378c17186211ec

  • SHA1

    fcf01b9e1bad3ca57415c372292b8471364efff8

  • SHA256

    58f66b4b4353b69aa0b43f778d88c0d12fa95e048f00a28d5c0d26f1cdc9e799

  • SHA512

    c3ce2b0718ebe1e9244d5b47893e606baf200962e6029baf5611d0b614af519b23648121e7e4791ab510eadf0ce28f9b648ca0edfd342b08f62c8620efe87f68

  • SSDEEP

    24576:Turz3eitBo/0uKoGSLs7bClwAIpxh8IXHjRHMULNTIX7V:Tk7xK/0yw7rjRZxIXB

  Score

  10^/10

  bandookpersistencerattrojanupx

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2