Search/Bandook
● Malware

Bandook

Bandook is a commercially available RAT, written in Delphi and C++, that has been available since at least 2007. It has been used against government, financial, energy, healthcare, education, IT, and legal organizations in the US, South America, Europe, and Southeast Asia. Bandook has been used by Dark Caracal, as well as in a separate campaign referred to as "Operation Manul".

View graph Watch Export
Indicators tracked
0
Intelligence Reports30
30 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
29 relationships
T1113: Screen Capture
source
T1056.001: Keylogging
source
T1123: Audio Capture
source
T1204.002: Malicious File
source
T1573.001: Symmetric Cryptography
source
T1566.001: Spearphishing Attachment
source
T1553.002: Code Signing
source
T1120: Peripheral Device Discovery
source
T1106: Native API
source
T1005: Data from Local System
source
T1140: Deobfuscate/Decode Files or Information
source
T1125: Video Capture
source
T1016: System Network Configuration Discovery
source
T1059: Command and Scripting Interpreter
source
T1083: File and Directory Discovery
source
T1041: Exfiltration Over C2 Channel
source
T1059.001: PowerShell
source
T1055.012: Process Hollowing
source
T1095: Non-Application Layer Protocol
source
T1027.003: Steganography
source
T1059.006: Python
source
T1059.003: Windows Command Shell
source
T1070.004: File Deletion
source
T1059.005: Visual Basic
source
T1105: Ingress Tool Transfer
source
T1680: Local Storage Discovery
source