BANDOOK(RAT)

 

  BANDOOK(RAT)-Malware
 

The payload in this attack is a variant of an old full-featured RAT named Bandook. Written in both Delphi and C++, Bandook has a long history, starting in 2007 as a commercially available RAT that was developed by a Lebanese individual nicknamed PrinceAli.Bandook’s execution flow starts with a loader, written in Delphi, that uses the Process Hollowing technique to create a new instance of an Internet Explorer process and inject a malicious payload into it. The payload contacts the C&C server sends basic information about the infected machine and waits for additional commands from the server.

Indicators of Compromise

File Hash

MD5
27f8d8bbbeeda5fc439ee18d9d4da343
44584c8d010242fddb44afe5ce860872
a6501c62b3a6ffa8d028a88138fe509f
7c15ee5b9a12dacaace8fb62271f12f1
4e9e12c98cfbc5f3aa3c1345bd063fa0
7ef261c151519e66ec369c63e4b1aed4
6effed1b1bb5e9ed6aafacb075c1d4e2
0475771b8bc3efc28b1834f3add608f3
045ce6679ed4086e2ded58470e24c15a
28ad9ace11919b57bf540e2b9debf8dd
5a3f7c46748791494e29383d1f58a908
07776b2dd00bcd0be1c7713c37d41120
d22b31848b6f17efc87d538dede2f2a7
b9b8d6f46ff3a9058ffe4b304604b4e7
573c7dbf4d3aed421bff58df770610fe
f037f3961f7d9fe1eb7afa889b556cb1
1a3889ded73044f8ba0a00c2f089a3bd
70ff19341dee7973ea6dd8e15c6ba86f
d6e524514e0d112015c841b62377d648
3f310215a70d748f9335c767e61a2ab4
bca04d74261fedfbd191ffd5e7cf6214
d1600f45005aa8b8fcbb446f34f7b9f5
4d7e67ed02713c789336f8804231b1ca
9bcf889b14968c61df95961a161719ba
54ad403349831b175a98a429f818f02a
83311c960609418d5f0a5160324ceb1d
96f09c5c56f59c733d1a9b01fea0cfb4
b5138c77983dba10c4976c411161bbf9
53b7bdd75776f342bf5f5395d4c46520
07111aff7afc052a81f267ea2e83dcef
eb402e8dd2cae58476acc8e697ee7171
cfea49c577ef865de659d5b8025db3f9
17fe9611ea566887b3ef42284f96de03
d1600f45005aa8b8fcbb446f34f7b9f5
4d7e67ed02713c789336f8804231b1ca
9bcf889b14968c61df95961a161719ba
54ad403349831b175a98a429f818f02a
83311c960609418d5f0a5160324ceb1d
96f09c5c56f59c733d1a9b01fea0cfb4
b5138c77983dba10c4976c411161bbf9
53b7bdd75776f342bf5f5395d4c46520
07111aff7afc052a81f267ea2e83dcef
eb402e8dd2cae58476acc8e697ee7171
cfea49c577ef865de659d5b8025db3f9
17fe9611ea566887b3ef42284f96de03


SHA-1
e78721fd283b0093fb0556167e1b38b81ed0c7bb
500813f95615b25f622e82e6c79431d7f4928bc4
118633bbe46520c65529c0cd1d6eb52f810f6327
154c16ecfa56b71ce7b6f3fca4be4e0820e34665
1e45d9c3ff9bb7e2ed236384694237dcd956de2b
788489ecd0e43f74c7d8df841bee8367cba2164d
8790c9c1ffdf7ce7d7c1a0825a73ef75958fd9c5
9087c24b181d58bb57d02a1ce19f8d17d63476b4
9b47ab36a00d83c119620318e4924ce50cec2512
9d0deca8dbdf25bdb9208772f861c28aa5a4e95f
a8f2b1f1a1200d25d751b5559a31c034781ea33e
b0d64b13407da0c6db1aced2d9e110802c05a6d3
c4d7332f09c7e917d5dd56930854e735cfce45fa
cf96410d1cde40aaebfe32f26354282a7773abaf
d6b69cb3689341997d93b03fbd4499fe60f29b35
49a8149054440e33a6228b42f731e2f8035049e5
03508cbeec86346d6658da8c9d34638c57dad920
9e33cbc25a8ad9987f88d5e1d181098142579f54
a31296f1eed15262f070abb3e89acf1a3917746a
47b8d74725f353dad8177c478ffa77d424e9a34e
f6b1b3fc532b516366de6b3452b5c23441386e17
816b2442c17585396b73b54fbc87be624d55276c
424e3570f36fdb541e9b49f9d6824949ccf96ea6
b1604a158cdd24182d8d4198fb17f4d348b92601
8c4d5618c3ab2d2411ede54f443560891a78986b
7f534338d1399221bb2134d917a1e3eef8b309e5
7e9fcbd7f31c3a4ddb3221351e8d04ecdce69474
57c9411b444ce4fddf6ddf210dd7dfd008c156ac
8971b585f8bf7d9f086d97d2d640ed4ce7f6b178
e98700d562edb0ed29e429d0263ec448daf8a5f2
55d1a679ae7e812d5c91ef78bec4095a2048427c
99e724a6941c65eed20ac13c4940e325fd323082
aad7ec556d8d6e4333552d23588734d339373ab8
816b2442c17585396b73b54fbc87be624d55276c
424e3570f36fdb541e9b49f9d6824949ccf96ea6
b1604a158cdd24182d8d4198fb17f4d348b92601
8c4d5618c3ab2d2411ede54f443560891a78986b
7f534338d1399221bb2134d917a1e3eef8b309e5
7e9fcbd7f31c3a4ddb3221351e8d04ecdce69474
57c9411b444ce4fddf6ddf210dd7dfd008c156ac
8971b585f8bf7d9f086d97d2d640ed4ce7f6b178
e98700d562edb0ed29e429d0263ec448daf8a5f2
55d1a679ae7e812d5c91ef78bec4095a2048427c
99e724a6941c65eed20ac13c4940e325fd323082
aad7ec556d8d6e4333552d23588734d339373ab8


SHA-256
1ad83e9d06428dd87203ab8fcc6142014a9c05f3eb9afd61347834f39082d72a
74feaf3aa116a88ef3b10453e77feadefbe4e53dd7a71dd3b8309cc9d76cdec9
034d8ec8d510033c387bb87cac35d240b7b8daa3b5167732118c755c5e6c1d48
072c103759968253b7b25837b43eec546c625ae9c04edd52321d848cf6078b87
0750c7cdc538d79d9ffed0d37f5d9a083902b49ec02d75ee88028db9f3668b59
40cc5933e608f7a2a5c13af1066257c9e41528bb85e434e2bc3d1f4802dec24d
5900abb869c61928f0ef931d6f9d8b62183b2bab9a69b0ef886551005d6c9622
8cb1f713761a6b31c9c25dd2c7ae11e575a634c9f052cfd598ada35a61783230
2ee74ae5b202c8aab288ca167c630e9ee3569240958e984474b960cd560bbe95
d217288a046e2739159d0081608a44c2e79d41de12c57ebe88a8591693fa15d5
a9a8b0aa5f137e7353db62dc1609da3c709ca30287a5605c73aafaf4968d1e8d
6287fc617ff6881169990e6b877c16d8ca3c199f7e453241a0b18a7907c67ab0
9de287f9af63f02c51c69d9c8480fee2bd4d4bd3c818f2ba81324b1f8ce495c0
306238a63896fa8b79b4c9a6d25fd906bb9e4919bc698608ab970677d15b0694
1b0d2d096c5f7fff02a5a4ce623b71b862f63e306a0760722f710c425b4e16ec
9a0ee2430f7c77942d544dad6787ca8a94470f6555f1cb08baa9d099c92f8447
766917fe9b543bf218bd824d55967d63f94b28456f1d4919bc990d8262dc608d
d4cf5c5c60e972cc19782d1f37ec9d47dd1e81cdf481b64dab62f96bac846bb4
6af6fe3eafd4cf2c82738d45a6a95577d970f3fbbe094afd24d1d4a0bb5ad1b4
9a19522b23acfc6705e4fac65640527a8adbbc9719dab436f28101b6cbc140c6
97ea91fb673f4994da491433751c4fca011993ba10191f09c70ca6c8d2b4f944
06ed3daccfbb30c68a33583a761fc20cc3e21adb8dd64a42d922e6da2a01c0dd
27c6341554a04bdc792ffbc5cda26511cbcfcc66334fb6ebbc24a14969b4e498
3fda0a5da313886b0339eee65c69c779ed620b303ba079ee0864ca4a1496b0b4
408c11caf548048732ac21e88a54e80d47a05b9619c1c16b65fa850e0172f428
41ccf6de0d51bd29d35be12ae24f04b2f88ec2b202b239424f90c666d25473e8
66c86f29afb1152aad8e426ebb6569ad03ce7b69ea3c8a5cc40011c2a3ab973b
aa868d007c4dfd825104faafb3798b9ab745b29794a57365bef41ec3f6019eea
add9f9dca97c3b6d52efe7d48ecd3d349a70411eaa3d4aeff6e6215b77f42b90
aed7ab5d0de01c3724c917c034e26a5e9eed3f7fbf4082b024576a41725d66cf
ba153e449ee926c019b548997c32d0579b9c6f350b1590a025d5d9a216ddbffd
ce8ad96819c814dd1735e621639a8845ae7132375879cc5b5d5f6877cb909a68
ea4792353e0f97968e7c69ffba81c144f22f54382af4e61a1347edd0ae15830f
06ed3daccfbb30c68a33583a761fc20cc3e21adb8dd64a42d922e6da2a01c0dd
27c6341554a04bdc792ffbc5cda26511cbcfcc66334fb6ebbc24a14969b4e498
3fda0a5da313886b0339eee65c69c779ed620b303ba079ee0864ca4a1496b0b4
408c11caf548048732ac21e88a54e80d47a05b9619c1c16b65fa850e0172f428
41ccf6de0d51bd29d35be12ae24f04b2f88ec2b202b239424f90c666d25473e8
66c86f29afb1152aad8e426ebb6569ad03ce7b69ea3c8a5cc40011c2a3ab973b
aa868d007c4dfd825104faafb3798b9ab745b29794a57365bef41ec3f6019eea
add9f9dca97c3b6d52efe7d48ecd3d349a70411eaa3d4aeff6e6215b77f42b90
aed7ab5d0de01c3724c917c034e26a5e9eed3f7fbf4082b024576a41725d66cf
ba153e449ee926c019b548997c32d0579b9c6f350b1590a025d5d9a216ddbffd
ce8ad96819c814dd1735e621639a8845ae7132375879cc5b5d5f6877cb909a68
ea4792353e0f97968e7c69ffba81c144f22f54382af4e61a1347edd0ae15830f


Comments

Post a Comment

Popular posts from this blog

Revil Ransomware Targeted Kaseya

Image
  Revil Ransomware Targeted Kaseya   REvil is a ransomware-as-a-service (RaaS), delivered by “affiliate” actor groups who are paid by the ransomware’s developers. The REvil actors launched a malicious update package that targeted customers of managed service providers and enterprise users of the on-site version of Kaseya’s VSA remote monitoring and management platform.   Indicators of Compromise URLs/Domains: architekturbuero-wagner.net mindpackstudios.com vitavia.lt bouncingbonanza.com lukeshepley.wordpress.com igfap.com bockamp.com levihotelspa.fi exenberger.at tinyagency.com familypark40.com alfa-stroy72.com boompinoy.com mdacares.com architecturalfiberglass.org slupetzky.at sinal.org qualitus.com deepsouthclothingcompany.com groupe-frayssinet.fr synlab.lt kamienny-dywan24.pl ilcdover.com humancondition.co...
Read more

Buer Loader provides malware-as-a-service

Image
  Buer Loader provides malware-as-a-service       Buer is a malware-as-a-service offering that is used to deliver whatever package the service customer desires, providing initial compromise of targets’ Windows PCs and allowing them to establish a digital beachhead for further malicious activity. Buer has previously been tied to banking trojan attacks and other malware deployments—and now, apparently, has been embraced by ransomware operators. In many ways, Buer is positioned as an alternative to Emotet and Trickbot’s emerging Bazar loader. “A new modular bot…written in pure C” with command and control (C&C) server code written in .NET Core MVC (which can be run on Linux servers). Indicators of Compromise File Hashes 10943b90969722bf359e4b039d2953e02072e03e0a7f1bdb1dea09d9197288b1 32616f41a71fc7a4286736a6fc77da2a555dbc8301a8bd5fbdbab231955a42c5 5b607f001ba62e042344d30b65cad2774df2deb50e0b92c33da85e9338c123c4   6c7f43434e5db8703c0a47dedeeab976159d8704bfb...
Read more