Extracted

Extracted

• • Target
    MasonGod.exe
  • Size 438KB
  • SHA256 f258e1faa4cbb6c3976d2e99e55f9a97da51d197f9fd9ba58553c2dd2541999e
  • MD5 da5e3b74fff72f0e14f29e5b5007ad59
  • SHA1 aa89be5706e274878d0304f931b36f605e7a7b19
  • SHA512 86844bf5ba6aa5059b73302376ff7614b31a42a95b558b3c0fd1176db1c77b74d49d4eb4ddc75398f5522c48a447afaec8071b4a3cd19ed2e35953fb4e1207b0
  • SSDEEP 6144:Bm+L1TkOrtomRarRweFvJKpsWyVFd5cdjigTG1bydf83gVPz+15JYJR5n:Bm+RTRKvYKJ5ixeyFvyGJ/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bdaejecxwormaspackv2backdoordefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationrattrojan

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies security service

    defense_evasion

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2