Procedure examples

Bandook can collect local files from the system .

Bandook has a command to get the public IP address from a system.

Bandook has used .PNG images within a zip file to build the executable.

Bandook can upload files from a victim's machine over the C2 channel.

Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.

Bandook contains keylogging capabilities.

Bandook can support commands to execute Java-based payloads.

Bandook has used PowerShell loaders as part of execution.

Bandook is capable of spawning a Windows command shell.

Bandook has used malicious VBA code against the target system.

Bandook can support commands to execute Python-based payloads.

Bandook has a command to delete a file.

Bandook has a command to list files on a system.

Bandook has a command built in to use a raw TCP socket.

Bandook can download files to the system.

Bandook has used the ShellExecuteW() function call.

Bandook is capable of taking an image of and uploading the current desktop.

Bandook can detect USB devices.

Bandook has modules that are capable of capturing audio.

Bandook has modules that are capable of capturing video from a victim's webcam.

Bandook has decoded its PowerShell script.

Bandook has used lure documents to convince the user to enable macros.

Bandook was signed with valid Certum certificates.

Bandook is delivered via a malicious Word document inside a zip file.

Bandook has used AES encryption for C2 communication.

Bandook can collect information about the drives available on the system.