Extracted

• • Target

    https://drive.google.com/file/d/1Co5rXfVJhNPvA3atvkEMmeKcyc5hxvGP/view?usp=drive_web

  Score

  10^/10

  bandookpersistencerattrojanupx

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1