Extracted

• • Target

    ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13.exe

  • Size

    141KB

  • MD5

    1b7b6fb1a99996587a3c20ee9c390a9c

  • SHA1

    129aa22329dd45f7bce5172e97cbd8016dec830e

  • SHA256

    ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13

  • SHA512

    a3b62e1c1184c01b0175b09f0a62003e120e652245ea80cebf9e55c89ef71308c4400bfe13281a60ae993c58d7dad5522688fa2e8924343e1baa5c25bfce44eb

  • SSDEEP

    3072:HACxLpcTIhjZM3VhHSkYl8CagwurZvE9vV1ZQZR:HTtpcPlJSTl4PuF

  Score

  10^/10

  warmcookiebackdoordiscovery

  • Warmcookie family

    warmcookie

  • Warmcookie, Badspace

    Warmcookie aka Badspace is a backdoor written in C++.

    backdoorwarmcookie

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2