Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1071700" data-attributes="member: 32260">WHHLight vs. Bandook(Smart App Control set to OFF)[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/new-bandook-rat-variant-resurfaces-targeting-windows-machines.128157/[/URL][URL unfurl=&quot;false&quot;]https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving[/URL][URL unfurl=&quot;false&quot;]https://app.any.run/tasks/82a56ab6-7816-4072-b1c4-78ecacf21f4e/[/URL]Attack flow:PDF document with URL ----&gt;&nbsp; 7-Zip archive&nbsp; downloaded from URL ---&gt; EXE malware embedded in archive injects itself into Windows system executable msinfo32.exeI tried Bandook samples from the second half of the year 2023 available on AnyRun and MalwareBazaar. Most of them were digitally signed, but the certificates were malformed. All samples were blocked by SmartScreen and independently by WDAC ISG in WHHLight.Some samples were unknown on VirusTotal, like the sample from AnyRun (uploaded to VT by me <a href="https://www.virustotal.com/gui/file/bd60639b3ac1f6c51631f384c9bff3318c2bcb5a9abe3ff8e3627c43cec85b43" target="_blank">[1]</a>.)It is possible that WDAC ISG could block the Bandook samples also as 0-day malware. The ISG has a very restrictive reputation backend and can block many signed files even if they are EV-signed (allowed by SmartScreen). Anyway, as any cloud reputation backend, also WDAC ISG may rarely miss something. If someone finds such a sample, please let me know.</blockquote>

[QUOTE="Andy Ful, post: 1071700, member: 32260"] [B][SIZE=5]WHHLight vs. Bandook[/SIZE] [SIZE=4][B](Smart App Control set to OFF)[/B][/SIZE][/B] [URL unfurl="false"]https://malwaretips.com/threads/new-bandook-rat-variant-resurfaces-targeting-windows-machines.128157/[/URL] [URL unfurl="false"]https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving[/URL] [URL unfurl="false"]https://app.any.run/tasks/82a56ab6-7816-4072-b1c4-78ecacf21f4e/[/URL] [B][COLOR=rgb(184, 49, 47)]Attack flow:[/COLOR] PDF document with URL ----> 7-Zip archive downloaded from URL ---> EXE malware embedded in archive injects itself into Windows system executable msinfo32.exe[/B] I tried Bandook samples from the second half of the year 2023 available on AnyRun and MalwareBazaar. Most of them were digitally signed, but the certificates were malformed. All samples were blocked by SmartScreen and independently by WDAC ISG in WHHLight. Some samples were unknown on VirusTotal, like the sample from AnyRun (uploaded to VT by me [URL='https://www.virustotal.com/gui/file/bd60639b3ac1f6c51631f384c9bff3318c2bcb5a9abe3ff8e3627c43cec85b43'][1][/URL].) It is possible that WDAC ISG could block the Bandook samples also as 0-day malware. The ISG has a very restrictive reputation backend and can block many signed files even if they are EV-signed (allowed by SmartScreen). Anyway, as any cloud reputation backend, also WDAC ISG may rarely miss something. If someone finds such a sample, please let me know. [/QUOTE]

Verification