Extracted

Extracted

• • Target

    17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe

  • Size

    899KB

  • MD5

    3db2c835eb5d134cba1ae703c5f914a0

  • SHA1

    ea5b12d0db70bbf138b3092142531fc357b2a4bf

  • SHA256

    17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99

  • SHA512

    9fb30c97f2edb4669e3e3ebfbd2c7b221a3438beee2ed53c7560a694c7db0959594cca92e0e317b88c75932abcfca551c0225d6f75898e2d1ca6a964f50f93d4

  • SSDEEP

    12288:Aaxr7vr7fYnPHv3jz/jDnTnbPr7Hf/TLzAHr3fP37bv/4wDvbwt2ThsA0eOzkv4d:Aad7PThOJkQFMhmC+6GD9Yuu1OUjezCu

  Score

  10^/10

  bdaejecxredaspackv2backdoordiscoverypersistence

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2