Extracted

Extracted

• • Target
    system32.exe
  • Size 342KB
  • SHA256 edb964bbc907072a3bcf2a056e5e26c6e90bf32c6ab39784904240e4ec2b6437
  • MD5 cf8304ce9ad5a555d82401bda9266a40
  • SHA1 c72274f8802160d5359c3d5bdc8f02164e0cd28d
  • SHA512 6ddb9816cf88d7d6ba507ac0535f2b8f363579a8d490ce7eb8eaa1abe304e0a26685dbf4724ff667eb54a3d0120eb39b2468a7f8b527c3c08df08c40a2ff8c72
  • SSDEEP 6144:dXv0qQtjc1kLrXC2dTccUQEGsI3Q0KmmX3+TclNmMOgg8L:dXOc1SC2DUfIApaclNmE
  • TLSH
    T1DB74F11373E0D4B6D4674A324D75D6F9BE7DB8514AB5874B23681A2F2DF03C18A3A322
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoor889discoverybdaejecvidarstealer

  • Detect Vidar Stealer

    stealer

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2