Extracted

• • Target

    12ae4f607b0b1aff973d7440b64ceca4b18236cca8592d53301a8df770b903b3

  • Size

    707KB

  • MD5

    74f45550738ded615663731227343b65

  • SHA1

    e08ac4a4f70da6b2d28b02532f0dc4560aef415e

  • SHA256

    12ae4f607b0b1aff973d7440b64ceca4b18236cca8592d53301a8df770b903b3

  • SHA512

    3d9edf1f8ffe4e89daa5b10b17fecef3087d9c50545f1c6efc906f4e546dce31dce7fe0ad56e4be1f957ad56b40683185a1c63e60f8d6956e6515d79c6f8e54f

  • SSDEEP

    12288:wD7qngcRLseprjstnxFe67Wkl8PggzmqGzXjDohvonDgL6jdbCjk8wFQWoPoS:wCJZdstxFe8WCfgzezvoloNbn8e

  Score

  10^/10

  bdaejecblackmoonaspackv2backdoorbankerdiscoverytrojan

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Blackmoon family

    blackmoon

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2