Overview

overview

10

Static

static

1

cotizacion...al.exe

windows7-x64

10

cotizacion...al.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cotizacion digital.exe

  • Size

    2.6MB

  • Sample

    230430-j8q55aah2w

  • MD5

    54aad82a97089ca95a8e04bdf725e571

  • SHA1

    769f5daaae9eb3256dc3f8937329a5c996b0f4df

  • SHA256

    ca255e39475e03fab80314b13b95219d8143d9689fdcdff7e4c2c9aeab39c010

  • SHA512

    553dfc6c11e58e2e2fbb4d5f2fbcd110107a70a9b53f4f4e0ab29645af09e2c39e30090f7710f640f3e2891f9300f535bba5b825c517809b4b1b03ad69870ccf

  • SSDEEP

    49152:0G2ZPpGVQpuux0xj8sFUUM+rERWGRsknWjOEa1GUB1g6D:0H

Score
10/10
bandookrattrojanupx

Malware Config

Extracted

Family

bandook

C2

deapproved.ru

Targets

    • Target

      cotizacion digital.exe

    • Size

      2.6MB

    • MD5

      54aad82a97089ca95a8e04bdf725e571

    • SHA1

      769f5daaae9eb3256dc3f8937329a5c996b0f4df

    • SHA256

      ca255e39475e03fab80314b13b95219d8143d9689fdcdff7e4c2c9aeab39c010

    • SHA512

      553dfc6c11e58e2e2fbb4d5f2fbcd110107a70a9b53f4f4e0ab29645af09e2c39e30090f7710f640f3e2891f9300f535bba5b825c517809b4b1b03ad69870ccf

    • SSDEEP

      49152:0G2ZPpGVQpuux0xj8sFUUM+rERWGRsknWjOEa1GUB1g6D:0H

    Score
    10/10
    bandookrattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks