Currently viewing ATT&CK v8.2 which was live between October 27, 2020 and April 28, 2021. Learn more about the versioning system or see the live site.
SOFTWARE
Aria-body
SOFTWARE
1-9
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
Y-Z
  1. Home
  2. Software
  3. Bandook

Bandook

Bandook is a commercially available RAT, written in Delphi, which has been available since roughly 2007 [1] [2].

ID: S0234
Type: MALWARE
Platforms: Windows
Version: 1.1
Created: 17 October 2018
Last Modified: 30 March 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1123 Audio Capture

Bandook has modules that are capable of capturing audio.[1]
Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

Bandook is capable of spawning a Windows command shell.[1]
Enterprise T1056 .001 Input Capture: Keylogging

Bandook contains keylogging capabilities[3]
Enterprise T1055 .012 Process Injection: Process Hollowing

Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.[2][1]
Enterprise T1113 Screen Capture

Bandook is capable of taking an image of and uploading the current desktop.[2]
Enterprise T1125 Video Capture

Bandook has modules that are capable of capturing from a victim's webcam.[1]

Groups That Use This Software

ID Name References
G0070 Dark Caracal

[2]

References

  1. Galperin, E., Et al.. (2016, August). I Got a Letter From the Government the Other Day.... Retrieved April 25, 2018.
  2. Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
  1. Galperin, E., Et al.. (2016, August 4). When Governments Attack: State Sponsored Malware Attacks Against Activists, Lawyers, and Journalists. Retrieved May 23, 2018.