Extracted

• • Target
    ghzffadoolu5kl2s.exe
  • Size 518KB
  • SHA256 6865571c577adee61b5f36e2e33b13c018bf18f6089ed89ff7c8c7552a003541
  • MD5 90770862a04d6156ef5f3fc6a53d6939
  • SHA1 ea120fae0fcf85bcb4e29c71886d2f90b83964eb
  • SHA512 242a15b99e726f8b95c668080640b663684e041617f8271979e6be0c7f6e3683e1ae4298367c3645d5f64dd7107e09fb20e65225aabfa6d7f1c83d2158b31aaa
  • SSDEEP 6144:x8I7is3zLJVXsMvOZNsDHQm19HpDtjcKPrIeZTkOzhn4XElPCxScNT4o8hlaTXWp:ifEJ1NGrUV1KP+B+yyoQNxa+By
  • TLSH
    T17BB43A257F998A08D441263E455E1908DBAEE1F226327303370AEF624D05DDEDE6D3EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareaspackv2backdoorbankerdiscoveryexecutionbdaejecramnitpersistenceprivilege_escalationspywarestealertrojanupxworm

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Family: Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1