General

  • Target

    LaSCFPV2.5.exe

  • Size

    142KB

  • Sample

    241021-ylzajsvdqq

  • MD5

    6753380e14eb1b19d5187af3e321901d

  • SHA1

    3d6a8450aff552a4929db8a0aa7843a57be282e5

  • SHA256

    11dae33626f2475a1511b9d5bfc9c858b56dfbc7c075e98c4ea7d1318e7288a4

  • SHA512

    bb980897e5ebf85ba9de5d656bd837779be001a402094b12661ebf3cbd62da9a8d2b13ea9882f65b8851a492a97ce76f49cbbccdb98678e2afe97d445fd0e413

  • SSDEEP

    3072:07DhdC6kzWypvaQ0FxyNTBfEcAEhpgQ8o4xkGCH:0BlkZvaF4NTBMc5gvo4x5

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      LaSCFPV2.5.exe

    • Size

      142KB

    • MD5

      6753380e14eb1b19d5187af3e321901d

    • SHA1

      3d6a8450aff552a4929db8a0aa7843a57be282e5

    • SHA256

      11dae33626f2475a1511b9d5bfc9c858b56dfbc7c075e98c4ea7d1318e7288a4

    • SHA512

      bb980897e5ebf85ba9de5d656bd837779be001a402094b12661ebf3cbd62da9a8d2b13ea9882f65b8851a492a97ce76f49cbbccdb98678e2afe97d445fd0e413

    • SSDEEP

      3072:07DhdC6kzWypvaQ0FxyNTBfEcAEhpgQ8o4xkGCH:0BlkZvaF4NTBMc5gvo4x5

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • Downloads MZ/PE file

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks