Extracted

• • Target

    e5ecd3f6e706ea8337ee03a9755fdb5fc1e733163127447465fc5d076a846e94

  • Size

    1.6MB

  • MD5

    8c1211586bfc80a44309510ee8d73a56

  • SHA1

    f13d6dfd2a514bd9a2b971d33e24ca8e6a32ab3b

  • SHA256

    e5ecd3f6e706ea8337ee03a9755fdb5fc1e733163127447465fc5d076a846e94

  • SHA512

    b2552635a29100a149cdc920808980f688ce423a46c79fc51e0ecefe0eed7782a9d72239d2df24599468c678e60270c68bba745a723e0858f822e529ff711275

  • SSDEEP

    24576:RGI2JM0h/Fl99cPHUj5oDwqrUNMCSNXVldQhe4Zoj6N8BP64xX7gec2:RGJJMif996U2DwyPsfZoLw4xXUec

  Score

  10^/10

  bdaejecblackmoonaspackv2backdoorbankerdiscoverytrojan

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Blackmoon family

    blackmoon

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2