General

  • Target

    e498e2e248a52898c35c08f6c29963ab3b88e692a2d9d7aef2a0f561938d2b0e

  • Size

    12.0MB

  • Sample

    241225-2met3szphy

  • MD5

    99bea2bdcd3ca80e38429876a8a4b39d

  • SHA1

    01a7e1e3c84f81cbb887d6a78a06727d0fef4c82

  • SHA256

    e498e2e248a52898c35c08f6c29963ab3b88e692a2d9d7aef2a0f561938d2b0e

  • SHA512

    5ebfe5043c70f01e83b6c8dd286f73339d4393e4c31919d50a246cccb64e841864317d8ded2e10b926cd1d9f4b42ced11da7f7c2eab6499365830bbdf5da6d25

  • SSDEEP

    49152:ug17vyyo6chV9wo4CrxdEOtBT8v5vF4y1HTJsZ:ugBLo6EV9wo4of8v5vWYls

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      e498e2e248a52898c35c08f6c29963ab3b88e692a2d9d7aef2a0f561938d2b0e

    • Size

      12.0MB

    • MD5

      99bea2bdcd3ca80e38429876a8a4b39d

    • SHA1

      01a7e1e3c84f81cbb887d6a78a06727d0fef4c82

    • SHA256

      e498e2e248a52898c35c08f6c29963ab3b88e692a2d9d7aef2a0f561938d2b0e

    • SHA512

      5ebfe5043c70f01e83b6c8dd286f73339d4393e4c31919d50a246cccb64e841864317d8ded2e10b926cd1d9f4b42ced11da7f7c2eab6499365830bbdf5da6d25

    • SSDEEP

      49152:ug17vyyo6chV9wo4CrxdEOtBT8v5vF4y1HTJsZ:ugBLo6EV9wo4of8v5vWYls

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Bdaejec family

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks