Extracted

• • Target

    Gorilla.exe

  • Size

    2.6MB

  • MD5

    b56d8e516dd406491e273cf22781f324

  • SHA1

    3640b9ea9de0dfd688901d9aeb3628a344f749ab

  • SHA256

    cbeb44540789ac8bf65368f68d9be851805fee65199d0c074a1171839b98ff12

  • SHA512

    a662c1f33adcede7ce9197d1bffbceb4db75fa0abf47c0b4eddc4c1cf98c0328370121ae3f272c6d46df80a7854eb31edd1755ec6f5f7f031065af516c5a11f3

  • SSDEEP

    49152:m1626Xz60rVn6QtNrDqCN03t3JPjd6idqkOkoLbr7Lbr7Lbr7LbriyCSiyCSiyC9:5j6WVn64BDqUKVZ6idqktn/

  Score

  10^/10

  bdaejecaspackv2backdoordiscoveryspywarestealer

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Downloads MZ/PE file

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1