General

  • Target

    50262945790796ad64fee89d297f3ec819ee8eb680a382880707c60f1d6e1250.exe

  • Size

    650KB

  • Sample

    241230-qkg1waymat

  • MD5

    fb4620146079b169056506442820dc2d

  • SHA1

    6d46cb7b515081f86b7de67f65d9f22ee50b36f5

  • SHA256

    50262945790796ad64fee89d297f3ec819ee8eb680a382880707c60f1d6e1250

  • SHA512

    d80b653fde4ee925f29c70d801263b5f11adbb9d27fc11bcbb0e5e74d5b0cd3c14845944844c684e0844e38741f1f9d73765de50c62d58b70b9ffebad03401a2

  • SSDEEP

    12288:RhMrzivePPYQmwPJKoXc8SM64DNRoXPirgSKzuqu:jMHivMPUgSp4DNv0xu

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      50262945790796ad64fee89d297f3ec819ee8eb680a382880707c60f1d6e1250.exe

    • Size

      650KB

    • MD5

      fb4620146079b169056506442820dc2d

    • SHA1

      6d46cb7b515081f86b7de67f65d9f22ee50b36f5

    • SHA256

      50262945790796ad64fee89d297f3ec819ee8eb680a382880707c60f1d6e1250

    • SHA512

      d80b653fde4ee925f29c70d801263b5f11adbb9d27fc11bcbb0e5e74d5b0cd3c14845944844c684e0844e38741f1f9d73765de50c62d58b70b9ffebad03401a2

    • SSDEEP

      12288:RhMrzivePPYQmwPJKoXc8SM64DNRoXPirgSKzuqu:jMHivMPUgSp4DNv0xu

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Bdaejec family

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks