General

  • Target

    8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040N.exe

  • Size

    303KB

  • Sample

    250102-dxvraasrdn

  • MD5

    0aa8d993c08ea9016c128a2305d3da90

  • SHA1

    dd8918ecf580fe41bf7eb3bb5c0a501e1fcd9b8a

  • SHA256

    8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040

  • SHA512

    d195b31db8c64d95b356005df1d40ea0310475b6cc088ebcfc19d49aa95b841345d0837cf1bf0aeded68abe5062fb7d0569d67b068f9ce247f28b160469dbf4c

  • SSDEEP

    6144:RdZiP3k3YeDgU5nMNsDQzcmGxF1RYTc3fD8Xhwm3zdiMMKpLI:RdZc0lp4PzanGQ3fAC2Mo

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040N.exe

    • Size

      303KB

    • MD5

      0aa8d993c08ea9016c128a2305d3da90

    • SHA1

      dd8918ecf580fe41bf7eb3bb5c0a501e1fcd9b8a

    • SHA256

      8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040

    • SHA512

      d195b31db8c64d95b356005df1d40ea0310475b6cc088ebcfc19d49aa95b841345d0837cf1bf0aeded68abe5062fb7d0569d67b068f9ce247f28b160469dbf4c

    • SSDEEP

      6144:RdZiP3k3YeDgU5nMNsDQzcmGxF1RYTc3fD8Xhwm3zdiMMKpLI:RdZc0lp4PzanGQ3fAC2Mo

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Bdaejec family

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks