In the dynamic arena of cybersecurity, remaining vigilant against emerging threats is paramount. This report dives into the resurgence of the Bandook remote access trojan (RAT), offering a nuanced perspective on its historical evolution, recent activities, and the sophisticated techniques employed in its distribution.

Malware overview: 

Bandook RAT, dating back to 2007, initially emerged as a commercial tool crafted by Lebanese creator PrinceAli. Over the years, leaked variants have transformed this RAT into a publicly available threat. After a period of relative dormancy, Bandook is resurging with digitally-signed variants targeting diverse sectors globally.

Upgrade and new threat vector:

The recent wave of Bandook exhibits a notable evolution. Digitally-signed variants, once virtually dormant, are now actively infiltrating sectors such as government, finance, energy, healthcare, and education across multiple countries. This resurgence emphasizes the adaptability of this RAT, raising concerns for organizations worldwide.

Indicators of Compromise (IOCs):

IOC Type  Value
File Hash (MD5)  cb30e5ba39200df4ed1934b0a29c9c44 
File Hash (SHA-1)  1d3e789186e3a7f39fc16e8c82cd77dd77bd0112 
File Hash (SHA-256)  4bf9325fe8d721e60c2a5beee8dbdf275ab9c5de309e162ecc81d1cdf7369cef 
File Hash (MD5)  b4487540e638679b9bc290c706add379 
File Hash (MD5)  e69e20bd1e9a855e180cff9fa66cc050 
File Hash (SHA-1)  2c606b6a7b3b6d55bb106fae368e9878512f66e7 
File Hash (SHA-1)  d1400dcf1682a636b4cba1f0637439c11b6528a7 
File Hash (SHA-256)  68bd9cc05f7846140e7d51ad44af155ba8cbdd48c0cfe2d8a41a995e63c65f58 
File Hash (SHA-256)  9dccab9f649757289944f61121e2502f7b3a1ae74a64a35f06dace2001c219d1 
Date of Detection  Nov 22, 2022, 5:40:44 PM 
Detection Type  Trojan Bandook 
Detection Type  Win32:InjectorX-gen\ [Trj] 


In conclusion, the resurgence of Bandook highlights the persistent threat posed by RATs in the cybersecurity landscape. The multifaceted nature of this malware, coupled with its evolving tactics, necessitates a proactive and comprehensive defense strategy. By understanding its history, refining detection mechanisms, and implementing preventive measures, organizations can fortify their cybersecurity posture against the ever-adapting Bandook RAT. 


Get in touch

Send us a Message

Looking for general information or have a specific question. Fill the form below or drop
us a line at