Extracted

Extracted

• • Target

    aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe

  • Size

    899KB

  • MD5

    66bdd4395672267e01f4dfdc12bfb140

  • SHA1

    bc6e038dd193b34a155c53f8eea8eaa5c1adf661

  • SHA256

    aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612

  • SHA512

    c2eb33bbd03727eb1692b80efc02cc7dcd250b74f6d5b181b1b0f57bc60b421740116c5d5e2caec59796fbbb1e46de3422f09a4a932988ba7be46a085cad70f0

  • SSDEEP

    12288:Aaxr7vr7fYnPHv3jz/jDnTnbPr7Hf/TLzAHr3fP37bv/4wDvbwt2ThTA0eOzkv4d:Aad7PThXJkQFMhmC+6GD9Yuu1OUjezCu

  Score

  10^/10

  bdaejecxredaspackv2backdoordiscoverypersistence

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2