Extracted

• • Target

    316e896d96b5732bfb62bcb85bebb11f8d30ae15e928aa28d4b5353f7d34bd6c

  • Size

    729KB

  • MD5

    b49c928135836d6de87a5e41212a767f

  • SHA1

    4bbb539b8c778263c5c5ec4da24ca4c41ae350fb

  • SHA256

    316e896d96b5732bfb62bcb85bebb11f8d30ae15e928aa28d4b5353f7d34bd6c

  • SHA512

    fdaf27811f36a7b66f4dfd52cf9b6c35d170ecc5ccac2d12a5627463db52658fb05c99555f4943679e3c55501d5a624c4e778c42a629d170ceb13b0899bf6c6f

  • SSDEEP

    12288:7sSh/Iv7VFkjN0tawVVdVVpbIo7deiblFKqZ7E7n/pwvqB9/fxDV8+MTocoS:7sr7gcPAoZNblF57g/pZ93xD

  Score

  10^/10

  bdaejecblackmoonaspackv2backdoorbankerdiscoverytrojan

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Blackmoon family

    blackmoon

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2