Overview

overview

10

Static

static

Confirmar ...ia.exe

windows7-x64

10

Confirmar ...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Confirmar Transferencia.exe

  • Size

    2.9MB

  • Sample

    230121-ll7wgadf3v

  • MD5

    d894efbc9e2d63b8ff959354e1307127

  • SHA1

    960b96e2e0f808d53ccc26f28fb0d66293ab7327

  • SHA256

    33ab6ca06026e2ac6592360374d20a319bcadd9e4e21a1644dae8ee6da952f49

  • SHA512

    51c5ff3e2674bc56b7098136770a72314c6acfddf6c0eaed06e3ea24480d8ae783aae2f01b4d4181ad6374381d596bb8febc98b73a1244e663f6f4251fc2f602

  • SSDEEP

    49152:eC3u7Xh4srWocjfd9vRUxD3dmgP8wfHKgF0QPStaEdE:eC+7x/rWor

Score
10/10
bandookpersistencerattrojanupx

Malware Config

Extracted

Family

bandook

C2

bomes.ru

Targets

    • Target

      Confirmar Transferencia.exe

    • Size

      2.9MB

    • MD5

      d894efbc9e2d63b8ff959354e1307127

    • SHA1

      960b96e2e0f808d53ccc26f28fb0d66293ab7327

    • SHA256

      33ab6ca06026e2ac6592360374d20a319bcadd9e4e21a1644dae8ee6da952f49

    • SHA512

      51c5ff3e2674bc56b7098136770a72314c6acfddf6c0eaed06e3ea24480d8ae783aae2f01b4d4181ad6374381d596bb8febc98b73a1244e663f6f4251fc2f602

    • SSDEEP

      49152:eC3u7Xh4srWocjfd9vRUxD3dmgP8wfHKgF0QPStaEdE:eC+7x/rWor

    Score
    10/10
    bandookpersistencerattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks