Overview

overview

10

Static

static

3

Factura_de...01.exe

windows7-x64

10

Factura_de...01.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Factura_de_pago#0101.exe

  • Size

    10.3MB

  • Sample

    230904-mzp39aff2v

  • MD5

    3ca635e112a87190cc373651c35f65d3

  • SHA1

    f7e87f471c5ef778771c3e8d14c4085550aac79a

  • SHA256

    981833615556263d376335312e04dcda5204a489a8362a8e7f69dd0c92cbe7c0

  • SHA512

    1fbff3366a83d34348697402b547972ea9165b55a5f441ede973a6777eb25093991099105493d1d41f2634d5873475342485d353414676c377f4771f781804e9

  • SSDEEP

    49152:lRyNxSzbVQ8KjAEmNP7XZPGA+DBo6ZZbi/ogWokoimnR2B+8J+E9g1Vr/1FhOsjH:lRe

Score
10/10
bandookrattrojanupx

Malware Config

Extracted

Family

bandook

C2

185.10.68.52

Targets

    • Target

      Factura_de_pago#0101.exe

    • Size

      10.3MB

    • MD5

      3ca635e112a87190cc373651c35f65d3

    • SHA1

      f7e87f471c5ef778771c3e8d14c4085550aac79a

    • SHA256

      981833615556263d376335312e04dcda5204a489a8362a8e7f69dd0c92cbe7c0

    • SHA512

      1fbff3366a83d34348697402b547972ea9165b55a5f441ede973a6777eb25093991099105493d1d41f2634d5873475342485d353414676c377f4771f781804e9

    • SSDEEP

      49152:lRyNxSzbVQ8KjAEmNP7XZPGA+DBo6ZZbi/ogWokoimnR2B+8J+E9g1Vr/1FhOsjH:lRe

    Score
    10/10
    bandookrattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks