Overview

overview

10

Static

static

1

Factura-Digital1.exe

windows7-x64

10

Factura-Digital1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Factura-Digital1.exe

  • Size

    3.1MB

  • Sample

    230501-ky1r9aeh59

  • MD5

    aeb416400d7317b4c2da0f95a4477e6f

  • SHA1

    03d2c0f8d341c38c28189ef0765d4e6b44059e5a

  • SHA256

    44b3604f4c30f95f4d2c3ac270e68f1b689411bd0706bfc915c517f4c3d0f122

  • SHA512

    354d920277079da14f30a10651661bba6a9bc46a55727ba90b056dd3dfbb9eea51761ad9b549f31fe846ab964121dc7034e331975930dd6f985024e39f49dc73

  • SSDEEP

    49152:YZipfIcB0CHEAf/rcEmuN0Ee2KxjbT981:YZwN

Score
10/10
bandookrattrojanupx

Malware Config

Extracted

Family

bandook

C2

deapproved.ru

Targets

    • Target

      Factura-Digital1.exe

    • Size

      3.1MB

    • MD5

      aeb416400d7317b4c2da0f95a4477e6f

    • SHA1

      03d2c0f8d341c38c28189ef0765d4e6b44059e5a

    • SHA256

      44b3604f4c30f95f4d2c3ac270e68f1b689411bd0706bfc915c517f4c3d0f122

    • SHA512

      354d920277079da14f30a10651661bba6a9bc46a55727ba90b056dd3dfbb9eea51761ad9b549f31fe846ab964121dc7034e331975930dd6f985024e39f49dc73

    • SSDEEP

      49152:YZipfIcB0CHEAf/rcEmuN0Ee2KxjbT981:YZwN

    Score
    10/10
    bandookrattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks