Overview

overview

10

Static

static

1

Cotizacion...88.exe

windows7-x64

10

Cotizacion...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cotizacion #055088.exe

  • Size

    3.4MB

  • Sample

    230430-j8rfwsha95

  • MD5

    83af5df6e9216551558cf370f66e3b30

  • SHA1

    2bc90b0a0007d4043ce846428fc65aa0a238f505

  • SHA256

    c3755679775c45969e3f4a9de00ab27bd0c497adff77a6fe44f4f09f0f02074f

  • SHA512

    c72c6b4fc7bb261dc55c5abe102cb1df438339149c0624075725fcff3cf22ff64dfe72c0c06bff945cd2237253a60f75120351fa0162b648b5f293e2ba4c1604

  • SSDEEP

    49152:4+0Pr1wVWjFFZCWKKpxiHy0sZnnBJoieEe:4W

Score
10/10
bandookrattrojanupx

Malware Config

Extracted

Family

bandook

C2

gombos.ru

Targets

    • Target

      Cotizacion #055088.exe

    • Size

      3.4MB

    • MD5

      83af5df6e9216551558cf370f66e3b30

    • SHA1

      2bc90b0a0007d4043ce846428fc65aa0a238f505

    • SHA256

      c3755679775c45969e3f4a9de00ab27bd0c497adff77a6fe44f4f09f0f02074f

    • SHA512

      c72c6b4fc7bb261dc55c5abe102cb1df438339149c0624075725fcff3cf22ff64dfe72c0c06bff945cd2237253a60f75120351fa0162b648b5f293e2ba4c1604

    • SSDEEP

      49152:4+0Pr1wVWjFFZCWKKpxiHy0sZnnBJoieEe:4W

    Score
    10/10
    bandookrattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks