Extracted

• • Target

    b3e4b1be3d6271f8a68b21809b3b8acaeb5a80541a79944f2f466b61109d059c

  • Size

    11.5MB

  • MD5

    2213447d6a5b56dbbcce43b7e3a6e641

  • SHA1

    f0bbf609b5c3182a17a6a5878283e025b23f233f

  • SHA256

    b3e4b1be3d6271f8a68b21809b3b8acaeb5a80541a79944f2f466b61109d059c

  • SHA512

    d229231148dfe8509272f2c7f4eeb3c7b4e5edeb9fa652989b06ffb2621244af438939d3cf166d24c0f5f5ab14585adf95d738a32dfa4886ce5502dd4370006d

  • SSDEEP

    196608:FAQuVH3M82sRhWphk2XmH24Wgf7TInXinHuE50PbdtwsmrKVveZleGxzLVyyqg:GLxM8r22PvInXinHuK0xCKVvetRVl

  Score

  10^/10

  bdaejecaspackv2backdoordiscoveryevasionthemidatrojan

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2