Extracted

• • Target

    719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b

  • Size

    1.4MB

  • MD5

    fd9433444004d326b35128f6ab7502c7

  • SHA1

    af0f10c2ce7d1d083a17654740475a697232a074

  • SHA256

    719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b

  • SHA512

    5b1c12d645c91eb73ba7ada105f0dea1f80cb4d4143712958d31bc6e337d3aa93c4151ee14afed1c7d5d0eb4b01c7a912bb264081e2191de7905c4d30ef4ad72

  • SSDEEP

    24576:8EqTh1sbKKx578K0wRpzeXrI/DYqCJ/lFATG7u258n86SERxpGwWDMKTF:8ErRxRDYpAa7uVn86SEWDM

  Score

  10^/10

  bandookpersistencerattrojan

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2