Extracted

Extracted

• • Target

    e909609bcd7d6a217635b372abba6e55d034d2e55712b032844ce28ded020064.exe

  • Size

    68KB

  • MD5

    02b3757b29002a8fcabd9afaebf1f7d3

  • SHA1

    cecffd787a418e435a9019211dda54444c2184fd

  • SHA256

    e909609bcd7d6a217635b372abba6e55d034d2e55712b032844ce28ded020064

  • SHA512

    fa7312829ddb66c4e3dba341eb45b2625c45060cfb2265a53ddb54595dd28d9245959eee6065b50e58d1908660732785a0430ae9345455d4bbcefd52fc5b015a

  • SSDEEP

    1536:sb1MsHz3JDwhyWr+N95OTga6S+PGCq2iW7z:XsT3JezcMCSkGCH

  Score

  10^/10

  bdaejecrunningrataspackv2backdoordiscoverypersistencerat

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • RunningRat

    RunningRat is a remote access trojan first seen in 2018.

    ratrunningrat

  • RunningRat payload

  • Runningrat family

    runningrat

  • Server Software Component: Terminal Services DLL

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2