Overview

overview

10

Static

static

1

Retenciones.exe

windows7-x64

10

Retenciones.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Retenciones.exe

  • Size

    3.2MB

  • Sample

    230430-ka8g7aah4y

  • MD5

    6bd530a8417b6ab6b5ea0230ebe16857

  • SHA1

    9e7cdf3192707cd06ef9626d3d1867a7e419b23e

  • SHA256

    ab8d1ee87ac5dc2adb51e45588ea7934aa3a50ceb4033ac2aca4d16f320ab609

  • SHA512

    8c7d0317d2112f79b062fc73bd8f45c8475dece6d624a3721e4b14d84b13eb40b4ff27259dfb5f29e129c3d714a33d12695bf134463b565beb5698d5dbe45104

  • SSDEEP

    49152:N+Laj3TXU7Ni5AacXjIuqGvGNP0FWtK7zI70l:ULATX0

Score
10/10
bandookrattrojanupx

Malware Config

Extracted

Family

bandook

C2

deapproved.ru

Targets

    • Target

      Retenciones.exe

    • Size

      3.2MB

    • MD5

      6bd530a8417b6ab6b5ea0230ebe16857

    • SHA1

      9e7cdf3192707cd06ef9626d3d1867a7e419b23e

    • SHA256

      ab8d1ee87ac5dc2adb51e45588ea7934aa3a50ceb4033ac2aca4d16f320ab609

    • SHA512

      8c7d0317d2112f79b062fc73bd8f45c8475dece6d624a3721e4b14d84b13eb40b4ff27259dfb5f29e129c3d714a33d12695bf134463b565beb5698d5dbe45104

    • SSDEEP

      49152:N+Laj3TXU7Ni5AacXjIuqGvGNP0FWtK7zI70l:ULATX0

    Score
    10/10
    bandookrattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks