Overview

overview

10

Static

static

1

Comprobant...24.exe

windows7-x64

10

Comprobant...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Comprobante Retenciones 24.exe

  • Size

    3.9MB

  • Sample

    230430-j741laha93

  • MD5

    c356527a53eb92909769240bc8d21f71

  • SHA1

    853e49f7b3fa0d998141e782bad9bd7bd5ffc09e

  • SHA256

    c31db09abd0d5b4b33b628dc48967247a77941759c24920603219dd66baf5778

  • SHA512

    cd7a9492246816346a58325dc9fba0757bb793ee36b8edbb789704b0afa6fcf2a10e09e67082036e0811ad3793a11112fe90fec25e48212f69f91d73d62d7e98

  • SSDEEP

    49152:GcHin0YtLXoVeXUmWDAk7Og2mp4BbF4L58w8LKWftklC5lY:G/n08XQO0

Score
10/10
bandookrattrojanupx

Malware Config

Extracted

Family

bandook

C2

deapproved.ru

Targets

    • Target

      Comprobante Retenciones 24.exe

    • Size

      3.9MB

    • MD5

      c356527a53eb92909769240bc8d21f71

    • SHA1

      853e49f7b3fa0d998141e782bad9bd7bd5ffc09e

    • SHA256

      c31db09abd0d5b4b33b628dc48967247a77941759c24920603219dd66baf5778

    • SHA512

      cd7a9492246816346a58325dc9fba0757bb793ee36b8edbb789704b0afa6fcf2a10e09e67082036e0811ad3793a11112fe90fec25e48212f69f91d73d62d7e98

    • SSDEEP

      49152:GcHin0YtLXoVeXUmWDAk7Og2mp4BbF4L58w8LKWftklC5lY:G/n08XQO0

    Score
    10/10
    bandookrattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks