Extracted

• • Target

    Comprobante Retenciones 24.exe

  • Size

    3.9MB

  • MD5

    c356527a53eb92909769240bc8d21f71

  • SHA1

    853e49f7b3fa0d998141e782bad9bd7bd5ffc09e

  • SHA256

    c31db09abd0d5b4b33b628dc48967247a77941759c24920603219dd66baf5778

  • SHA512

    cd7a9492246816346a58325dc9fba0757bb793ee36b8edbb789704b0afa6fcf2a10e09e67082036e0811ad3793a11112fe90fec25e48212f69f91d73d62d7e98

  • SSDEEP

    49152:GcHin0YtLXoVeXUmWDAk7Og2mp4BbF4L58w8LKWftklC5lY:G/n08XQO0

  Score

  10^/10

  bandookrattrojanupx

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2