Extracted

• • Target
    OverwackLoader.exe
  • Size 361KB
  • SHA256 b10b7e309499e040cdd1430ae96c64bd7ae14b863587c4533ba9d802e88a3608
  • MD5 e313c64dfc3f2795524d01c20f0c822d
  • SHA1 0635891848a6912a6302724b2115f3592d13ab13
  • SHA512 6c045170a51bfed454de2a7f8d1f53f268ebed2e7ad1d9630567e11666a72081672df876074613e3d0225ab205befe4d6c3120f0773e4289e46101b72d02f9af
  • SSDEEP 6144:llN1nVcjLRw9tLkVVShFabh0dQa0hJn4iGp5egweE+fCSJQVfiGfgkULxbQRJ3Tc:/aF0dQFn4iGp5etenfCSJQVfiGfgbxb9
  • TLSH
    T139747D92EE8291F3E6CA01B891F7AB774D358D25A3109AC3E3D15DB14C216D0A23A7DD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoverybdaejecadwarepersistenceransomwarespyware

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2