Extracted

• • Target

    bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480

  • Size

    1.6MB

  • MD5

    752e301ae1f726fd98279c779a31ef2e

  • SHA1

    b2dca2b0913cbdc98d652917adcd157c778957c0

  • SHA256

    bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480

  • SHA512

    aaac35a116456d1a06c4e491265fab870ea41b28cdb35d93ba94276b75e1a418754fc9b3f35917ead90ef3959a7c3fab032a69298a8d0c0da6c2d949ad5d9fdd

  • SSDEEP

    49152:ploCs/JrR6MYq4jRUiXXFpBdftBYxnbmFVpQhaYG:plOR96MR4VjLQnbUVpiG

  Score

  10^/10

  bandookevasionpersistencerattrojan

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2