General

  • Target

    6f764cdd074a37f44a69b31c03ca42ec5d05cb2f6703e6645210ebef3eef4b53.exe

  • Size

    432KB

  • Sample

    250116-r2l7lawkdq

  • MD5

    68f96709c0109db0028a7d67c680a461

  • SHA1

    b48a11a8e76918b83a4774b41c86bbb51a83269c

  • SHA256

    6f764cdd074a37f44a69b31c03ca42ec5d05cb2f6703e6645210ebef3eef4b53

  • SHA512

    a222e825ca0d78ee3a7354f77b39b593aae39864921061220ed880b2ad58b426a99a5a929df8ba3d38f3be5bb8568e9f273806b4e3dd7dfb3fe9d86bfe0b8f60

  • SSDEEP

    6144:vvYjUy/29kMLQHxI5STKSiJvzAdBfpjG+CePQNPVvsHN8XS6U9JqKn:vvYjK9OTKsBfpjGpPNPMisGi

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      6f764cdd074a37f44a69b31c03ca42ec5d05cb2f6703e6645210ebef3eef4b53.exe

    • Size

      432KB

    • MD5

      68f96709c0109db0028a7d67c680a461

    • SHA1

      b48a11a8e76918b83a4774b41c86bbb51a83269c

    • SHA256

      6f764cdd074a37f44a69b31c03ca42ec5d05cb2f6703e6645210ebef3eef4b53

    • SHA512

      a222e825ca0d78ee3a7354f77b39b593aae39864921061220ed880b2ad58b426a99a5a929df8ba3d38f3be5bb8568e9f273806b4e3dd7dfb3fe9d86bfe0b8f60

    • SSDEEP

      6144:vvYjUy/29kMLQHxI5STKSiJvzAdBfpjG+CePQNPVvsHN8XS6U9JqKn:vvYjK9OTKsBfpjGpPNPMisGi

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Bdaejec family

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks