Overview

overview

10

Static

static

1

Nuevo_Docu...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nuevo_Documento2607.pdf.exe

  • Size

    6.9MB

  • Sample

    230726-zxntmafg93

  • MD5

    c688b50e5b47539ab29e4e748737391a

  • SHA1

    24f9be8db519190abdeb4e211c5be863c31f349d

  • SHA256

    7fccc0fd1db4123276163e62b4b152efaebe17228a72e1d91cc0109a61a247be

  • SHA512

    af672fa317e62e32cd500567910501f00b693549cc7b1d120830b0c7754f3a86df4b435998f14259da268e4a2ea5cc40e324875a4dd3f7399c738360fabb37fd

  • SSDEEP

    49152:YW1L/cM04WxPi0ooPGpFA0k2spoDAffLPnwTaxcKotmQk1s/6wXSsT1pRb/Ce9vK:YW1LkM0v

Score
10/10
bandookrattrojanupx

Malware Config

Extracted

Family

bandook

C2

185.10.68.52

Targets

    • Target

      Nuevo_Documento2607.pdf.exe

    • Size

      6.9MB

    • MD5

      c688b50e5b47539ab29e4e748737391a

    • SHA1

      24f9be8db519190abdeb4e211c5be863c31f349d

    • SHA256

      7fccc0fd1db4123276163e62b4b152efaebe17228a72e1d91cc0109a61a247be

    • SHA512

      af672fa317e62e32cd500567910501f00b693549cc7b1d120830b0c7754f3a86df4b435998f14259da268e4a2ea5cc40e324875a4dd3f7399c738360fabb37fd

    • SSDEEP

      49152:YW1L/cM04WxPi0ooPGpFA0k2spoDAffLPnwTaxcKotmQk1s/6wXSsT1pRb/Ce9vK:YW1LkM0v

    Score
    10/10
    bandookrattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Matrix

Tasks