defection.io

malware

Bandook S0234

Type: malware
Platform: Windows
Created: 17 October 2018
Last modified: 25 April 2025

Bandook is a commercially available RAT, written in Delphi and C++, that has been available since at least 2007. It has been used against government, financial, energy, healthcare, education, IT, and legal organizations in the US, South America, Europe, and Southeast Asia. Bandook has been used by Dark Caracal, as well as in a separate campaign referred to as "Operation Manul".[1][2][3]

TechniquesTop 11%

TacticsTop 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

malware

Bandook S0234

Type: malware
Platform: Windows
Created: 17 October 2018
Last modified: 25 April 2025

TechniquesTop 11%

TacticsTop 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Bandook MITRE reference S0234

Data from Local System T1005 ↗

Bandook can collect local files from the system.4

Collection22 detection rules

System Network Configuration Discovery T1016 ↗

Bandook has a command to get the public IP address from a system.5

Discovery25 detection rules

Steganography T1027.003 ↗

Bandook has used .PNG images within a zip file to build the executable. 6

Stealth5 detection rules

Exfiltration Over C2 Channel T1041 ↗

Bandook can upload files from a victim's machine over the C2 channel.7

Exfiltration16 detection rules

Process Hollowing T1055.012 ↗

Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.8 9 10

Privilege Escalation · Stealth6 detection rules

Keylogging T1056.001 ↗

Bandook contains keylogging capabilities.11

Credential Access · Collection3 detection rules

Standing S0234

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques26Top 11%

89th percentile · 89% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics10Top 6%

94th percentile · 94% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique15.5med35th pct

35th percentile · 65% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique4med28th pct

28th percentile · 72% of 825 ATT&CK software entries have more atomic tests per technique.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1med57th pct

57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 26 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 648Splunk ESCU (cumulative) · 274