General

  • Target

    JaffaCakes118_6007bf9244bd9accb3f1a75100b44580

  • Size

    212KB

  • Sample

    250101-w8wrtszngr

  • MD5

    6007bf9244bd9accb3f1a75100b44580

  • SHA1

    14859626db40cb11bc0fe9d773ff0c697c819589

  • SHA256

    feb2e9203c50fe9d51b46e3b146c9e0000ac5f11d67b57ef1835b86f2807d49a

  • SHA512

    eaae3406f8a10d75d4446def713b4c6a3db3023597b02b4dc78260ca07d71a467ad3cc70a6fa6ff6c0cf7fbf1e329233bda0fc79f7e9cf405e4414d9c5892b30

  • SSDEEP

    3072:xuE5COzDVjEPR6KEZ86nFAmi7gCoPiDqUlGyGRc21IAGCH:UE51JjEP4ZnFAmi7Pq4GRG

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      JaffaCakes118_6007bf9244bd9accb3f1a75100b44580

    • Size

      212KB

    • MD5

      6007bf9244bd9accb3f1a75100b44580

    • SHA1

      14859626db40cb11bc0fe9d773ff0c697c819589

    • SHA256

      feb2e9203c50fe9d51b46e3b146c9e0000ac5f11d67b57ef1835b86f2807d49a

    • SHA512

      eaae3406f8a10d75d4446def713b4c6a3db3023597b02b4dc78260ca07d71a467ad3cc70a6fa6ff6c0cf7fbf1e329233bda0fc79f7e9cf405e4414d9c5892b30

    • SSDEEP

      3072:xuE5COzDVjEPR6KEZ86nFAmi7gCoPiDqUlGyGRc21IAGCH:UE51JjEP4ZnFAmi7Pq4GRG

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Bdaejec family

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks