Extracted

• • Target

    2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3

  • Size

    1.3MB

  • MD5

    b3a99ca4931d97592b6011f47f80855e

  • SHA1

    76484423af9d832e5ac4c45a8567092bf83aa247

  • SHA256

    2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3

  • SHA512

    d6bb94d6efe726ebbc5b75f851d622878991b593988d2df896cbdcee6ad0e8106160d40592cb046e325083f3ed8fc362bf55d143dfaa001aa4f3500b894a7460

  • SSDEEP

    24576:Bi0jbZw96tmhNSaWPxEQo10+6hd13IvcI71ctt08kIy:BrwxKxEQoX63dpE

  Score

  10^/10

  bandookrattrojan

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • Suspicious use of SetThreadContext

  behavioral1behavioral2