Extracted

• • Target

    https://filedn.com/lDvy0twfPspJQGA0clfyBJV/multis1/Dia-09_12569.7z

  Score

  10^/10

  bandookmicrosoftpersistencephishingrattrojanupx

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • Drops file in Drivers directory

  • Sets service image path in registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers COM server for autorun

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Detected potential entity reuse from brand microsoft.

    phishingmicrosoft
  behavioral1