Overview

overview

10

Static

static

1

Solicitud ...́.exe

windows7-x64

10

Solicitud ...́.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Solicitud de comprá.exe

  • Size

    4.6MB

  • Sample

    230301-vydylagg7x

  • MD5

    795d1f81ac926d3e071eacef70e595c1

  • SHA1

    73301458ce9c775e6416fbe9f1921ecc4f69d099

  • SHA256

    e2e984b3044ab8f96ec284dc2af339923fb6cdded37a551125c899a1c60376a3

  • SHA512

    c436fd1ebc99d384c434e2b6b6494fefa7f18ccae6de755491ae03b234b6f08fcb616a5a60e89b6e80356cbf00c39ddc8e350e6bad8f23285498a906b9df5a85

  • SSDEEP

    49152:nvPLNuoyGZVhMfUhJKehyrNru0bqMpjgK9aSN6wtiGe50oO6z7YYA698nTnUkcNW:nvPRBIsTKehy3

Score
10/10
bandookrattrojanupx

Malware Config

Extracted

Family

bandook

C2

gombos.ru

Targets

    • Target

      Solicitud de comprá.exe

    • Size

      4.6MB

    • MD5

      795d1f81ac926d3e071eacef70e595c1

    • SHA1

      73301458ce9c775e6416fbe9f1921ecc4f69d099

    • SHA256

      e2e984b3044ab8f96ec284dc2af339923fb6cdded37a551125c899a1c60376a3

    • SHA512

      c436fd1ebc99d384c434e2b6b6494fefa7f18ccae6de755491ae03b234b6f08fcb616a5a60e89b6e80356cbf00c39ddc8e350e6bad8f23285498a906b9df5a85

    • SSDEEP

      49152:nvPLNuoyGZVhMfUhJKehyrNru0bqMpjgK9aSN6wtiGe50oO6z7YYA698nTnUkcNW:nvPRBIsTKehy3

    Score
    10/10
    bandookrattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks