General

  • Target

    3f78157bc69d91b4651fb247534c48ab70d511c36565749199b5360bd850a6e4N.exe

  • Size

    538KB

  • Sample

    250224-zld52svlx6

  • MD5

    69ab79a62c3d023470e715ff1221dfa0

  • SHA1

    35320089dda64cb1883283d9cb7978e865656337

  • SHA256

    3f78157bc69d91b4651fb247534c48ab70d511c36565749199b5360bd850a6e4

  • SHA512

    a370cd1ed57e31de31d86203b86ae02bb5a69af81fe04b5e3291ab960652035737b027771b526efe833d590d47a4a684e8b9e870c74122d1cf5cc1f3b9678f80

  • SSDEEP

    12288:hrMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9V:3ZyCA8CBmn+RrNj9ay5I

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Targets

    • Target

      3f78157bc69d91b4651fb247534c48ab70d511c36565749199b5360bd850a6e4N.exe

    • Size

      538KB

    • MD5

      69ab79a62c3d023470e715ff1221dfa0

    • SHA1

      35320089dda64cb1883283d9cb7978e865656337

    • SHA256

      3f78157bc69d91b4651fb247534c48ab70d511c36565749199b5360bd850a6e4

    • SHA512

      a370cd1ed57e31de31d86203b86ae02bb5a69af81fe04b5e3291ab960652035737b027771b526efe833d590d47a4a684e8b9e870c74122d1cf5cc1f3b9678f80

    • SSDEEP

      12288:hrMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9V:3ZyCA8CBmn+RrNj9ay5I

    • Bdaejec

      Bdaejec is a backdoor written in C++.

    • Bdaejec family

    • Detects Bdaejec Backdoor.

      Bdaejec is backdoor written in C++.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks