General

  • Target

    Loader.exe

  • Size

    593KB

  • Sample

    250213-wz1dnasjhv

  • MD5

    7513aaaa736bf8d2b2a6d06a007fa6d2

  • SHA1

    00d0077fd72d0046da42744474728b668776a1db

  • SHA256

    2f2b62f010f743124767b36ed6e0c3f885a1ad0db036a65dca5f7ec20dc74919

  • SHA512

    d8e0cc24274a075ea7ffd6745eb6d294de3639fcd51765499cab1966f53dff7f365325ab523280cca7b456eb23930f7776e77a968485a5f796932d4bcb424567

  • SSDEEP

    12288:fmeOfxCoEB9DzYwLM8sNfuuKSmtkTGKKlmJj9//k/rTcPcYYYgYYYYYYYgYYYYYH:fxOp5uVLyqKKlmJj9//k//Ic

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      Loader.exe

    • Size

      593KB

    • MD5

      7513aaaa736bf8d2b2a6d06a007fa6d2

    • SHA1

      00d0077fd72d0046da42744474728b668776a1db

    • SHA256

      2f2b62f010f743124767b36ed6e0c3f885a1ad0db036a65dca5f7ec20dc74919

    • SHA512

      d8e0cc24274a075ea7ffd6745eb6d294de3639fcd51765499cab1966f53dff7f365325ab523280cca7b456eb23930f7776e77a968485a5f796932d4bcb424567

    • SSDEEP

      12288:fmeOfxCoEB9DzYwLM8sNfuuKSmtkTGKKlmJj9//k/rTcPcYYYgYYYYYYYgYYYYYH:fxOp5uVLyqKKlmJj9//k//Ic

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Bdaejec family

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • Downloads MZ/PE file

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks