Overview

overview

10

Static

static

1

COTIZACION...D3.exe

windows7-x64

10

COTIZACION...D3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    COTIZACION SOLICITADA_22D3.exe

  • Size

    1.6MB

  • Sample

    230501-kyzvyseh57

  • MD5

    fd9fb71a9a3f389a73c9b2b6d2060021

  • SHA1

    c57eca88d6d8ad1523f2b86a720c6f70a7d9766c

  • SHA256

    60eecb884a1b16f80657569edf121d6a8f489081befae1ecd1d26e9233e58104

  • SHA512

    872b5c5a02ad773a2062fa7bb48de1bcf82bccfa12c2fb11c348097fb79428a394467cf134da525274e32bcdae9c85512fd88d49b8a7dac33da19da3b6b44486

  • SSDEEP

    24576:RuBHAm0A536Omg122tsK8Tz4aoURxqiaDQF6KljwbGRNW0x4GSWmo3E6c3mNC1ly:Ru9P/ghxxqjSZljPVmo4sGo

Score
10/10
bandookrattrojanupx

Malware Config

Extracted

Family

bandook

C2

deapproved.ru

Targets

    • Target

      COTIZACION SOLICITADA_22D3.exe

    • Size

      1.6MB

    • MD5

      fd9fb71a9a3f389a73c9b2b6d2060021

    • SHA1

      c57eca88d6d8ad1523f2b86a720c6f70a7d9766c

    • SHA256

      60eecb884a1b16f80657569edf121d6a8f489081befae1ecd1d26e9233e58104

    • SHA512

      872b5c5a02ad773a2062fa7bb48de1bcf82bccfa12c2fb11c348097fb79428a394467cf134da525274e32bcdae9c85512fd88d49b8a7dac33da19da3b6b44486

    • SSDEEP

      24576:RuBHAm0A536Omg122tsK8Tz4aoURxqiaDQF6KljwbGRNW0x4GSWmo3E6c3mNC1ly:Ru9P/ghxxqjSZljPVmo4sGo

    Score
    10/10
    bandookrattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks