Extracted

• • Target

    b7edddb3d7041c22515c911b667c0150N.exe

  • Size

    1.2MB

  • MD5

    b7edddb3d7041c22515c911b667c0150

  • SHA1

    3281cf78a8584b1498c064be10d3418bd221b29c

  • SHA256

    8f1ede8e647860581f1baa5f3c5eed5d4e8bbfd64ddfe896f9a92106d1ef19f3

  • SHA512

    f2a10053bcfffdbf14c7042b069369551e0b974d9524ac4e9ad70656a510e59b095acf391d3660b448da4059ad33537e48a90243df8a70967cfb4edfa7b7c46a

  • SSDEEP

    24576:2ryExVz6NBWgLSffv5b8zJE8WipL5Nbs85ak:24aF8KiZ5u

  Score

  10^/10

  bandookdiscoverypersistencerattrojan

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

    rattrojanbandook

  • Bandook payload

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2