Overview

overview

10

Static

static

3

IM00114PRES.exe

windows7-x64

7

IM00114PRES.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IM00114PRES.exe

  • Size

    12.0MB

  • Sample

    231014-n4zzpaff42

  • MD5

    0788c6ffcf438e660909c108c60984d4

  • SHA1

    e36b267a952dbc7f3d2dc09cb087a44af43a5ae3

  • SHA256

    9d2c845c497b734d8cfa74b90cbb1191fc25de53652c8b4d510a23cca75dfba7

  • SHA512

    1590776a8f40ef600624e01fee8d74823793dfec059bb8fd3099629b31b5a2e189708ee298243e90ac44e27c43078ed4291a652434e003761f9dd3dcf627b69d

  • SSDEEP

    49152:NFZaH72h213UhRjvtw2WvwMwB9ydpyn4ewRcuBaHaK0NyqZm8NPnroNygC8aCOku:NFH21

Score
10/10
bandookrattrojanupx

Malware Config

Targets

    • Target

      IM00114PRES.exe

    • Size

      12.0MB

    • MD5

      0788c6ffcf438e660909c108c60984d4

    • SHA1

      e36b267a952dbc7f3d2dc09cb087a44af43a5ae3

    • SHA256

      9d2c845c497b734d8cfa74b90cbb1191fc25de53652c8b4d510a23cca75dfba7

    • SHA512

      1590776a8f40ef600624e01fee8d74823793dfec059bb8fd3099629b31b5a2e189708ee298243e90ac44e27c43078ed4291a652434e003761f9dd3dcf627b69d

    • SSDEEP

      49152:NFZaH72h213UhRjvtw2WvwMwB9ydpyn4ewRcuBaHaK0NyqZm8NPnroNygC8aCOku:NFH21

    Score
    10/10
    upxbandookrattrojan

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks