Overview

overview

10

Static

static

2c619d413f...c3.exe

windows7-x64

10

2c619d413f...c3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3

  • Size

    1.3MB

  • Sample

    221127-226aksba2w

  • MD5

    b3a99ca4931d97592b6011f47f80855e

  • SHA1

    76484423af9d832e5ac4c45a8567092bf83aa247

  • SHA256

    2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3

  • SHA512

    d6bb94d6efe726ebbc5b75f851d622878991b593988d2df896cbdcee6ad0e8106160d40592cb046e325083f3ed8fc362bf55d143dfaa001aa4f3500b894a7460

  • SSDEEP

    24576:Bi0jbZw96tmhNSaWPxEQo10+6hd13IvcI71ctt08kIy:BrwxKxEQoX63dpE

Score
10/10
bandookrattrojan

Malware Config

Extracted

Family

bandook

C2

jaysonj.no-ip.biz

Targets

    • Target

      2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3

    • Size

      1.3MB

    • MD5

      b3a99ca4931d97592b6011f47f80855e

    • SHA1

      76484423af9d832e5ac4c45a8567092bf83aa247

    • SHA256

      2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3

    • SHA512

      d6bb94d6efe726ebbc5b75f851d622878991b593988d2df896cbdcee6ad0e8106160d40592cb046e325083f3ed8fc362bf55d143dfaa001aa4f3500b894a7460

    • SSDEEP

      24576:Bi0jbZw96tmhNSaWPxEQo10+6hd13IvcI71ctt08kIy:BrwxKxEQoX63dpE

    Score
    10/10
    bandookrattrojan

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks