Extracted

• • Target

    a855fa52c07ea362123e8cd9fd293824a46fac160c88819aae2cb4212b63bec4

  • Size

    2.3MB

  • MD5

    339d10e5c34d820024d08ddafee21b52

  • SHA1

    97037d550aa84387147267bcb23f9de34ce19da3

  • SHA256

    a855fa52c07ea362123e8cd9fd293824a46fac160c88819aae2cb4212b63bec4

  • SHA512

    17e1d3652845afc9c8d19e9cb76d1ce65968290db7b66ed7d05290d2b27395ccf64a76eb021935b88aea23eec8e86653906915406a0d9b02973576b62400bc66

  • SSDEEP

    49152:HtNUaQsh3Ss/flyXP8BnzoVPgfpQO21F8k:HtNUA3vlyXPE0qR

  Score

  10^/10

  bdaejecblacksuit_windowsaspackv2backdoordiscoveryransomware

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • BlackSuit

    A ransomware first detected in May 2023 linked to the Conti group.

    ransomwareblacksuit_windows

  • Blacksuit_windows family

    blacksuit_windows

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Detects the Windows variant of BlackSuit Ransomware

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2