Backdoor.Win32.Bandok.dz
Known Bandook RAT backdoor
Detects Bandook RATDetects an XORed URL in an executable
SHA-256f156f35aa57a0c13f3040724e16c4f932cbee5bc682fff542e80d016759fad8c
MaleculeMdTh
Evidence
⋯3 more rows
0x140488786000000000000643430306467387c........d400dg8|
0x14058819d9d99d3c6c69e9e9ec785869f8cc7................
0x140688a8684c69a8c9d9d80878e9ac79d919d................
0x1407800000000000000000000000000000000................
0x1408800000000000000000000000000000000................
0x1409800000000000000000000000000000000................
0x140a8616161616161317c998085809d88c787aaaaaa1|........
0x140b886c48099c78a86840000000000000000................
0x140c800000000000000000000000000000000................
0x140d800000000000000000000000000000000................
0x140e800000000000000000000000000000000................
0x140f80000000000000000616161616161327c........aaaaaa2|
0x14108d8d8dfde000000000000000000000000................
0x1411800000000000000000000000000000000................
0x141280000000000000000616161616161337c........aaaaaa3|
0x141389a9f8a81869a9dc78c918c0000000000................
0x1414800000000000000000000000000000000................
0x141580000000000000000616161616161347c........aaaaaa4|
0x1416892abdfa8d1d9dea7dfc4dddbadafc4dd................
0x14178bed9dbc4d0daacdcc4abd8dcdfabdaaf................
0x14188a8d1a8a5d8940000616161616161357c........aaaaaa5|
0x141989a9f8a81869a9d000000000000000000................
⋯15 more rows
⋯7 more rows
0x144a86e746f736b726e6c2e65786500000000ntoskrnl.exe....
0x144b8257325642e65786500000000536f6674%s%d.exe....Soft
0x144c8776172650000000076737a0030000000ware....vsz.0...
⋯15 more rows
⋯3 more rows
0x166f86578706c6f7265722e65786500000000explorer.exe....
0x16708687474703a2f2f7777772e676f6f676chttp://www.googl
0x16718652e636f6d00000025647c25737c2573e.com...%d|%s|%s
⋯7 more rows