Bandook
Software · ATTACK:enterprise:S0234
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0234",
"title": "Bandook",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0234",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--835a79f1-842d-472d-b8f4-d54b545c341b",
"external_id": "S0234",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2025-04-25T14:43:54.316Z",
"version": "2.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Lookout Dark Caracal Jan 2018",
"url": "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"
},
{
"source_name": "CheckPoint Bandook Nov 2020",
"url": "https://research.checkpoint.com/2020/bandook-signed-delivered/"
},
{
"source_name": "EFF Manul Aug 2016",
"url": "https://www.eff.org/files/2016/08/03/i-got-a-letter-from-the-government.pdf"
}
]
}Explicit source assertions (27)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1123
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1148c339-09f2-4518-9562-c6aa11d5474f
EFF Manul Aug 2016ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13ef6179-f624-4a3f-8095-a86609e31828
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3379cbbb-cb69-4dbd-856c-70f88eb256bc
EFF Manul Aug 2016 · CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3450fcde-caba-4595-b28b-99f18b4a4b7a
BH Manul Aug 2016ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cc0af18-2897-4008-a2b0-0234df50acde
Lookout Dark Caracal Jan 2018 · EFF Manul Aug 2016 · CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47afdb05-0327-4feb-b80e-1be491b57693
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5047ac79-8ed7-4f22-bfa2-fad8195f72b8
EFF Manul Aug 2016ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5791055c-1a0c-460e-91cc-7d85278ce533
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a453aab-789d-4fd5-9360-37c3f88ee3c6
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7bf27f61-0191-4c20-ae96-96c38322470d
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--817f5a5a-c22b-4d49-8e5a-35b48da7c358
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89e07be1-6d8b-4886-ab3d-68fb23275c8c
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a80ece05-37e1-4828-a9e8-27b30524960b
Lookout Dark Caracal Jan 2018 · CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1ef4ee2-30bc-4f25-9e77-cf9d6cc576a8
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b36ef70d-6691-4f3b-a1ca-08d4aadaac7e
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b42354ae-384d-4885-96a0-1594ed6dd427
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4beede8-130b-4c99-b123-f7079896e28d
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd5fd2c2-a9a3-401e-8723-92df94f9c482
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c339e33e-11c1-4fd3-a117-fab3e44bc714
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4f9c2ad-f740-4b08-9788-c058b98f2094
EFF Manul Aug 2016ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cab79b3a-4ea7-455a-9373-e8ac0d8e612f
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd9d7183-d7c2-4253-ab57-1c53a6d00a1a
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7f3c107-cf9c-4cb3-9d58-56199962e8c5
CheckPoint Bandook Nov 2020ATTACK:enterprise:G0070 → uses → ATTACK:enterprise:S0234
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e30bb29e-1f1c-4d68-9720-ae99da0c84ee
Lookout Dark Caracal Jan 2018 · CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebd78850-caf0-4e14-8338-0f7347063afc
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5f24a8f-6d98-4f00-9db2-e92189f7d67a
CheckPoint Bandook Nov 2020ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff471404-75be-4ebe-a585-4b6d1d27887e
CheckPoint Bandook Nov 2020