Extracted

• • Target

    9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f

  • Size

    671KB

  • MD5

    c0832808c793bb3907ea7b483835fc87

  • SHA1

    ef0a266a98b4b68a36ad922dd3bc21d8dc752d3d

  • SHA256

    9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f

  • SHA512

    23e9c6dc1eda806316ae3d0a0ab3e624395b965b140fd5e93983735f4aecec50f68091977e09e68d3ceef72bfa7ad3d69ce5d4cfec19808a6d152a1eb7c1212c

  • SSDEEP

    12288:XJfUodPt85Phq3+rxZP7xY710le0lyyGshuhVT6S7bSqQWRfNIoS:XJfUodPt8NC8P1Y71z+ashuhB6PW

  Score

  10^/10

  bdaejecblackmoonaspackv2backdoorbankerdiscoverytrojan

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Blackmoon family

    blackmoon

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2