Extracted

• • Target

    Confirmar Transferencia lista.exe

  • Size

    2.9MB

  • MD5

    9d62eda2d552cb2f7e1564209de10310

  • SHA1

    a0a5da7e38bf029ffa91b7b6f16f4da10f2763b0

  • SHA256

    fa031dbd614e7231d329906a6aefdbeea4c6b2ceee847e909ff66126a370ceaa

  • SHA512

    189b4905fb991ff3842c539d24617251799d736dde3df40fdd8653fb782736244ce202f760cf9e1c10496f31fda7f9aa20253d4c642a9f22bd27cebfeeb1cfba

  • SSDEEP

    49152:vfc6jJzftLicMY1xMHeNBHFAJyye2IwF1q9emDAZ:v0617tLi

  Score

  10^/10

  bandookpersistencerattrojanupx

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2