General

  • Target

    63288211c225286ba675d3ce5e171f46863b9c890c4d585bd46bd35986642cf6N.exe

  • Size

    235KB

  • Sample

    250101-zxfs1swpgp

  • MD5

    43ab66104aabb64d800c8bd3a69e7200

  • SHA1

    3b2d8713e4fe0d2d49d35d5b218233ecce5da0a7

  • SHA256

    63288211c225286ba675d3ce5e171f46863b9c890c4d585bd46bd35986642cf6

  • SHA512

    b1615962c1e8f1859b01240f33e24c229b82a8a65a0b7c0aedc89820ad512e447fde8fa47e6d5b4c0058905088114dd6da593ec3c1fa4502afab4543631c640d

  • SSDEEP

    3072:1BZCTeuPMa1+Hq8uAzb/O+pKtlyx4FrUTtnRLizIONVPE+CoFm1Y9urdWjwY5sH5:4HvwUtl+UUTFZOLEEsWjbUq5B5

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      63288211c225286ba675d3ce5e171f46863b9c890c4d585bd46bd35986642cf6N.exe

    • Size

      235KB

    • MD5

      43ab66104aabb64d800c8bd3a69e7200

    • SHA1

      3b2d8713e4fe0d2d49d35d5b218233ecce5da0a7

    • SHA256

      63288211c225286ba675d3ce5e171f46863b9c890c4d585bd46bd35986642cf6

    • SHA512

      b1615962c1e8f1859b01240f33e24c229b82a8a65a0b7c0aedc89820ad512e447fde8fa47e6d5b4c0058905088114dd6da593ec3c1fa4502afab4543631c640d

    • SSDEEP

      3072:1BZCTeuPMa1+Hq8uAzb/O+pKtlyx4FrUTtnRLizIONVPE+CoFm1Y9urdWjwY5sH5:4HvwUtl+UUTFZOLEEsWjbUq5B5

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Bdaejec family

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks