General

  • Target

    180bb4096818344fa9874bcb252b8a87900a0f9861d75a71859a7d8b629b2237N

  • Size

    50KB

  • Sample

    241020-llejxs1emg

  • MD5

    0d20f67c4790219816869e7f0b037fb0

  • SHA1

    b8d9bc207d15e01a94f1d9229adeb78abee539b6

  • SHA256

    180bb4096818344fa9874bcb252b8a87900a0f9861d75a71859a7d8b629b2237

  • SHA512

    cb2feb26685113056f9af735f0ddcc62c52c8041ed934e828d9e879b18b77733a2dfd5a6011a365d0cb4a7ccfcc036ed7a80ae9a968eb1539f07fc4e54ef0c53

  • SSDEEP

    768:uwsbi4i9QebPsnUrukDDd828fRRTnqQGPL4vzZq2o9W7GsxBbPr:uwsbi4i9QKPQUrdPR+RTnJGCq2iW7z

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      180bb4096818344fa9874bcb252b8a87900a0f9861d75a71859a7d8b629b2237N

    • Size

      50KB

    • MD5

      0d20f67c4790219816869e7f0b037fb0

    • SHA1

      b8d9bc207d15e01a94f1d9229adeb78abee539b6

    • SHA256

      180bb4096818344fa9874bcb252b8a87900a0f9861d75a71859a7d8b629b2237

    • SHA512

      cb2feb26685113056f9af735f0ddcc62c52c8041ed934e828d9e879b18b77733a2dfd5a6011a365d0cb4a7ccfcc036ed7a80ae9a968eb1539f07fc4e54ef0c53

    • SSDEEP

      768:uwsbi4i9QebPsnUrukDDd828fRRTnqQGPL4vzZq2o9W7GsxBbPr:uwsbi4i9QKPQUrdPR+RTnJGCq2iW7z

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks