Overview

overview

10

Static

static

3

4f1923485e...a3.exe

windows7-x64

10

4f1923485e...a3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f1923485e8cdd052467d335a6384f93cd1d50b5d927aea471e56290be29ffa3.zip

  • Size

    512KB

  • Sample

    230710-rm6mpabb43

  • MD5

    39d5d504bbc5eb5a8155cfe891c7bb3f

  • SHA1

    b288f6050f210e12f24b847e9796d509b6997fef

  • SHA256

    5a5b3147c482cc9e7cc703a4f222412872f3a00241a28190f5199cf3b04af704

  • SHA512

    6c8b73249282dd7437e5f629e66ec1634e1bc65f2ea2d8250749d00501a231d0b81acea99cb1a3aa8dd50bae38b75b6893d9067478709c8169a6eb9f7a6d5147

  • SSDEEP

    12288:45FtgLFSl+NQt4Izfz/7m+kn+Ny6Pdq3Nm8qA:45nUSd4MfnpJNykdC/H

Score
10/10
bandookpersistencerattrojan

Malware Config

Extracted

Family

bandook

C2

iamgood.blogdns.net

Targets

    • Target

      4f1923485e8cdd052467d335a6384f93cd1d50b5d927aea471e56290be29ffa3.exe

    • Size

      977KB

    • MD5

      f000ca9522aafa0c54b863528228a43b

    • SHA1

      c636e88b9e8079ba086f5cdb132fa39e747d0f23

    • SHA256

      4f1923485e8cdd052467d335a6384f93cd1d50b5d927aea471e56290be29ffa3

    • SHA512

      ccbb478d676a3c6f1355ab30933196c5bf41b64b613e8efe661546c238700ce2aec340390af9069c303a43bc7c4f41400c418920041cf4967c6e02b272ef372d

    • SSDEEP

      24576:2ZcgQmXNGZQFXu+pcUKR9ZS2hWN8ow/hvdY/:2ZBgZRZUwJ

    Score
    10/10
    bandookrattrojanpersistence

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks