Extracted

• • Target

    E88.30_CheckPointVPN.exe

  • Size

    61KB

  • MD5

    c9e06f125bec06a184f50d82659104cc

  • SHA1

    34e8ee115a12efbf6603e9b97bdccaf1e0c69403

  • SHA256

    2bf8594ea21ca101000de7993a55ecdfa5ef34c96b020d87b634ad23a6594d3d

  • SHA512

    d9afb386dfc79ae401c3e8015cd5fdf018bd7f6f5456ca01d5f2bec702fba546133fdcb279cf7aec1163fc108ddb134116f24b127271dfeefdf8da1388adbfe8

  • SSDEEP

    1536:fiarTMDj7EDePNlRMK8yAiIysblda47pcIc6W:qwTMwD0Nl38kIjdaai

  Score

  10^/10

  warmcookiebackdoordiscovery

  • Warmcookie family

    warmcookie

  • Warmcookie, Badspace

    Warmcookie aka Badspace is a backdoor written in C++.

    backdoorwarmcookie

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2