General

  • Target

    8ffba760a94a7f13bd1031a83bbfaeef7852788ebc576195254faeb0b66c5dd2N.exe

  • Size

    432KB

  • Sample

    250117-fceknstjhq

  • MD5

    dcfdf94848398f49193b6821bd540b60

  • SHA1

    aa841c7ec02fdb8b47871f6abcc57735a12f7a73

  • SHA256

    8ffba760a94a7f13bd1031a83bbfaeef7852788ebc576195254faeb0b66c5dd2

  • SHA512

    fbd1f3a23da6026f0455bc09c00c5ee1827d37d43376d0980bc35f7d6c080b0cd2671432a4a32e9132f66fbe5bc661235cfb48e102743db44c296a519052ebcd

  • SSDEEP

    6144:vvYjUy/29kMLQHxI5STKSiJvzAdBfpjG+CePQNPVvsHN8XS6U9JqK:vvYjK9OTKsBfpjGpPNPMisG

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      8ffba760a94a7f13bd1031a83bbfaeef7852788ebc576195254faeb0b66c5dd2N.exe

    • Size

      432KB

    • MD5

      dcfdf94848398f49193b6821bd540b60

    • SHA1

      aa841c7ec02fdb8b47871f6abcc57735a12f7a73

    • SHA256

      8ffba760a94a7f13bd1031a83bbfaeef7852788ebc576195254faeb0b66c5dd2

    • SHA512

      fbd1f3a23da6026f0455bc09c00c5ee1827d37d43376d0980bc35f7d6c080b0cd2671432a4a32e9132f66fbe5bc661235cfb48e102743db44c296a519052ebcd

    • SSDEEP

      6144:vvYjUy/29kMLQHxI5STKSiJvzAdBfpjG+CePQNPVvsHN8XS6U9JqK:vvYjK9OTKsBfpjGpPNPMisG

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Bdaejec family

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks