Extracted

• • Target

    Visualizarpdf-print-29052023.exe

  • Size

    5.2MB

  • MD5

    79441b006a2145fa62d02622400ac2e6

  • SHA1

    89d8c2e884766d0e1d4e460903f7dae0075bbaf5

  • SHA256

    512dc2e5252c2063a348f3475789b0cd02fce90c68f17845e3b99dd2fd8049e4

  • SHA512

    c1432f553466d11d3ade7397f09fca62288e02538ee00ad5c86c432d84f4e0b826d3f82bd3b251de362039e2ba40f65b5fb8e181d71e566360b92147966831ec

  • SSDEEP

    49152:ybVKnrKEdSQZaH5GcLo3Fj/Z92N9QjCuX+kVoNkvMdm66w5HO6vrVlZruEk:y8B

  Score

  10^/10

  bandookpersistencerattrojanupx

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2