Overview

overview

10

Static

static

3

Fact_#00256.exe

windows7-x64

7

Fact_#00256.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Fact_#00256.exe

  • Size

    12.2MB

  • Sample

    231009-l2sfqaeb92

  • MD5

    0ed92b3833c659a68be6a3a2f03ddcd1

  • SHA1

    8ebaadf8fa61d0df070c13a27bc269b1b2f20e92

  • SHA256

    e56da3db578d96a9d94752ee80539b1a3aaea4b0305892aa4a5fab74dbbeb6f8

  • SHA512

    fa67dfc9c7a4a1ccbdc9a08ef40399146d5f735e708aa4392aa0a88cec3cb38927b34bd1f9796bd4928fc7674004d27b29e6a3e8281de1612dede8fe6cd89dd2

  • SSDEEP

    49152:5F3eFJ17qhl7Mrpuo/skg2O144bQVcPNA/za2nIVAHSfq2vt9cXYWh1nV5sF5ov8:5FuFJp

Score
10/10
bandookrattrojanupx

Malware Config

Extracted

Family

bandook

C2

45.67.34.219

Targets

    • Target

      Fact_#00256.exe

    • Size

      12.2MB

    • MD5

      0ed92b3833c659a68be6a3a2f03ddcd1

    • SHA1

      8ebaadf8fa61d0df070c13a27bc269b1b2f20e92

    • SHA256

      e56da3db578d96a9d94752ee80539b1a3aaea4b0305892aa4a5fab74dbbeb6f8

    • SHA512

      fa67dfc9c7a4a1ccbdc9a08ef40399146d5f735e708aa4392aa0a88cec3cb38927b34bd1f9796bd4928fc7674004d27b29e6a3e8281de1612dede8fe6cd89dd2

    • SSDEEP

      49152:5F3eFJ17qhl7Mrpuo/skg2O144bQVcPNA/za2nIVAHSfq2vt9cXYWh1nV5sF5ov8:5FuFJp

    Score
    10/10
    upxbandookrattrojan

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks