General

  • Target

    40807b6d1faacd3b77f1bcc61c24a7e443fe8cf01bfaa044b908b5f4c16d8a40N

  • Size

    32KB

  • Sample

    241011-y1gdaa1gqa

  • MD5

    ff2234207d6641fa4c192b1ae1f33d60

  • SHA1

    0dea8d8a5867a292f452605b5429a665ec1546df

  • SHA256

    40807b6d1faacd3b77f1bcc61c24a7e443fe8cf01bfaa044b908b5f4c16d8a40

  • SHA512

    3c612c2f93751716d9c37f0de90ed2066e1182b6b106c6e32075763809ec289ae5867c0c964bd51636668f87af65615092bbd0adaea1c8076f3cf7984a5aab50

  • SSDEEP

    768:bQGPL4vzZq2o9W7GsxBbPrQfQGPL4vzZq2o9W7GsxBbPr:cGCq2iW7zU4GCq2iW7z

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      40807b6d1faacd3b77f1bcc61c24a7e443fe8cf01bfaa044b908b5f4c16d8a40N

    • Size

      32KB

    • MD5

      ff2234207d6641fa4c192b1ae1f33d60

    • SHA1

      0dea8d8a5867a292f452605b5429a665ec1546df

    • SHA256

      40807b6d1faacd3b77f1bcc61c24a7e443fe8cf01bfaa044b908b5f4c16d8a40

    • SHA512

      3c612c2f93751716d9c37f0de90ed2066e1182b6b106c6e32075763809ec289ae5867c0c964bd51636668f87af65615092bbd0adaea1c8076f3cf7984a5aab50

    • SSDEEP

      768:bQGPL4vzZq2o9W7GsxBbPrQfQGPL4vzZq2o9W7GsxBbPr:cGCq2iW7zU4GCq2iW7z

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks