Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/10/2024, 19:31 UTC

241009-x8h2eawgpc 10

09/10/2024, 19:27 UTC

241009-x6cfvawgjc 10

General

  • Target

    VBR.exe

  • Size

    7.6MB

  • Sample

    241009-x8h2eawgpc

  • MD5

    81711a07e09960fb3cff42a395a0d6da

  • SHA1

    a0ee96f364149e8b49758773106916accd212f83

  • SHA256

    ee67215d30e8b08d54518f88ecdb0fdbb7f2791960c0021f799d122c745608e7

  • SHA512

    f68faef3d59878c52011c77ad7e66c5e7bae5ce3c435635bacd78c1f8efea682fec688f2676d55130e268dbc3a4261c518029dbae36527e356507d3636869cc1

  • SSDEEP

    196608:Hyd0cDeQLjv+bhqNVoBKUh8mz4Iv9Pfu1D7c:9ieAL+9qz8/b4INuRc

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      VBR.exe

    • Size

      7.6MB

    • MD5

      81711a07e09960fb3cff42a395a0d6da

    • SHA1

      a0ee96f364149e8b49758773106916accd212f83

    • SHA256

      ee67215d30e8b08d54518f88ecdb0fdbb7f2791960c0021f799d122c745608e7

    • SHA512

      f68faef3d59878c52011c77ad7e66c5e7bae5ce3c435635bacd78c1f8efea682fec688f2676d55130e268dbc3a4261c518029dbae36527e356507d3636869cc1

    • SSDEEP

      196608:Hyd0cDeQLjv+bhqNVoBKUh8mz4Iv9Pfu1D7c:9ieAL+9qz8/b4INuRc

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Stops running service(s)

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.