bdaejec | 5968928c3dfe885f003de54af705cb065b94b8814713882c0c6e2193929bdc4a

Sharing

Copy URL Twitter E-mail

General

Target
5968928c3dfe885f003de54af705cb065b94b8814713882c0c6e2193929bdc4a
Size 3.5MB
Sample261107-x8cjma1vbw
SHA256 5968928c3dfe885f003de54af705cb065b94b8814713882c0c6e2193929bdc4a
MD5 5c3624bcc1ed285d746b6a7565a6511b
SHA1 9c330a998023be0f3c18ed82c5b66a335a61249b
SHA512 402a67bb576a7720cda3bc9187ab1308bf51496cd2f8a00f9f9923ba24476b0d3cb887543ffb353fbf10183a6e1136f8cf3b79052af20d90fffd9d1af790ddae
SSDEEP 98304:WEpgdwHeM5lZ+5yy8+hEpc+duwneM5lZ+5W:vS6Vn+y+I3dRVn+8
TLSH
T14206333E1DF02A3AD8614AA3ACD92459C7AC7F8D71305E26E2F154311FDD7A40A7782B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Targets

- Target
  AMCap.exe
- Size 632KB
- SHA256 ef9717b44bfd73a4805be6933e75a56eafa69001ccdcbd5ddc0783bb25011f08
- MD5 c295f6e905ca3dd7a6a40d7a0d55c903
- SHA1 52c698bae0f12f91547b8c251b5f6932709badef
- SHA512 e9f7f578abfe028b4bf86e91727e138450a340abaebbc93571efa962d089a7b693486f754e193572bc26c2424b61672107bf27da87ac9cc42c1520b3330e94d7
- SSDEEP 12288:+rX7x+Ibz29ZoKMzjGFE2NQHrNtBFvTaB58nfd18sW:y4I2nE22j85efd1L
- TLSH
  T13ED45C2237D1C076C17234724B5AA3B526AFB87149765B0B7BD40B3D2F746B29E2831E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

aspackv2 backdoor defense_evasion discovery execution bdaejec
- Detects Bdaejec Backdoor.
  Bdaejec is backdoor written in C++.
- Family: Bdaejec
  Bdaejec is a backdoor written in C++.
  backdoor bdaejec
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2
- Target
  win10_64bit/ksthunk.sys
- Size 28KB
- SHA256 d717ce30ee9e1faaa59837e0755ed57fd76629aa28e241c23269bbbfc430ef0e
- MD5 7e3bedef17ffc3da9e2e306138c5250f
- SHA1 4f937ebd5283d80c61a421f331633f996f612f0e
- SHA512 52cef4527b165bb93322739515276f576a599cd8b7d2526e89030debd25a593f8b884b97c7be9cfe88c7a6ea6cc69542927bf478ea934aee6edfad621cb6eb1f
- SSDEEP 384:BO1I4riAsiDlnTqrp1DCz1Dh37gyPuQjkqWP2kx4qay+H+wf38WTXwWLO:gbsgsp1e5DV7gymwkvecBsc
- TLSH
  T1DED22A9CF2FA28DAE16AC13C86EA1296E7B1F831535257DF4150CA395E33DD0D835E20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  win10_64bit/usbvideo.sys
- Size 293KB
- SHA256 d68b9dd00ca0f2fcf257f9196bef73d2346fe6967f88d4f476fd09a675eb3812
- MD5 369b1e5b2b2cd45f62cbcbb83c9d2e77
- SHA1 6c2d4a2df7722a92c8c92027326c7663a217f5c2
- SHA512 20cacde80277564171687447201c18218bc198b2ce9cf35fd4bb2f5ce5fe8560d989a6eade21153bffac0e71227962e2cdc466c41a4ee5a70849e87f37e0b4c6
- SSDEEP 6144:P3v30U4w00E3uSI7QM1qamycIAMkIuxYwHRsDn31AiHmQfKYPu/Pnpv+J:H30U4aE3uSISYcUmQfKYPuHQJ
- TLSH
  T166545C1DF3691CB4D4E6C074ADA65119ABB13C171B62E6DB10B0C978BF03ED8B978728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  USB /win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/²(1).docx
- Size 172KB
- SHA256 fbe7c3b6483ad723adc304a3e36cb4c0b5fa94fab1f975b7649ba4e70c220ef3
- MD5 f23585b37977925067aa18f3e02d2619
- SHA1 f4fed5c1cd1bb5d297c29e62db37d4e873f7ddf2
- SHA512 237d3155f6446ba4ce2e14d3cc71b15b5038a94ccba471cbdf41060ac12f5ca28fe4f425f4317c9d10952c17948c9fb212d435c1ee98b420e2a9104891087b0a
- SSDEEP 3072:d4g86sd8cUP1t3/poITtgvsq0LkDudYnW2+kZYbOQLUfp4Ia9rlRf:Gg+dpUPX/pdTtgkpLkDuSWbkZYlop92r
- TLSH
  T18904E067D815CD52C2F94179B1C38144C83A98A8E7BEE035CCA36DE9F2ECFC932151A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  USB /win7 32λ64λϵͳUVCºװ˵/WIN 7 װ֮ǰȷϵϵͳ.docx
- Size 315KB
- SHA256 514f606abd07575d2b81d11b1c5f27c831d12754f79281b72b65e31835420873
- MD5 4746583426c1bf63406303c09905ce7f
- SHA1 dc886388c0951232b3f567e2975ae3957e6f5936
- SHA512 1f3c16fb7f124277153acfec295123274aa68d136bfba60b6d968c915ba8918b54ec6e1e604d388adcf6c34bcc7264a6344748d6e552bac4f7420623a834ef33
- SSDEEP 6144:ziUxyfF42u8hFuzwP1FKuCaumGykQiWGI8iZIVPZE0Mbg8FvSeDVEdbb+4l:fxqu/sPzumGykQsOsFMbg8oeBEdbb+4l
- TLSH
  T17364F0B3D0B43033C8B6CE7C5C4927493D3A5CA950BEAA65DAC97D8D262F1ED294344E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  usbvideo.inf_x86_neutral/usbvideo.sys
- Size 142KB
- SHA256 12f1abdd5c871147afc682bcef099f319a4f542ac3f0b647d7a5dfe63edae061
- MD5 f642a7e4bf78cfa359cca0a3557c28d7
- SHA1 c59d6d66ad63b6f059473229832ca87eb769cca6
- SHA512 1fbe2bba439a96dffaa947f336229f368c7e01f49877803319dc55579778bdd15c63e1bdbf03af9397bc580672cb88c179f3e801730f6cf24c9cc7348565c7ea
- SSDEEP 3072:Cep5wyDz2/ZdSPq9ZhNuUMa8AiWkqKaQOl3FVBE8wNt9:R7a/SPqTvFknaQOl3bBO
- TLSH
  T1C8E3C636B05045F6D8A723B4524EB276EE5EE0EC1B1AF7E740A00FE47A68EC14D35786
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  win7_64bit/ksthunk.sys
- Size 20KB
- SHA256 866a23e69b32a78d378d6cb3b3da3695ffdff0fec3c9f68c8c3f988df417044b
- MD5 6869281e78cb31a43e969f06b57347c4
- SHA1 a490c8f4c501652cb732b63620bebe261f457117
- SHA512 f87e4958dcb67e79439264fd0c812a8e493f150ab1022f6f9cb2fc881eeb1b4b3e7cd6a8ed65b64d8fdce6745fc87468394abb254e55946fe2d542901093a4b6
- SSDEEP 384:8PF5txvHHgXvrpMEiRz0Lf4a0HMJj6h2NIxxxV5EK7V6v0JWtwXwW:/ve0LQaCMJD2Es4v0H
- TLSH
  T14892394AA2E108BDF57A813EC3C72397E7B1B446631107EF1264565E2E2BFD49D3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  win7_64bit/usbvideo.sys
- Size 181KB
- SHA256 6d3de5bd3ef3a76e997e5baf900c51d25308f5a9682d1f62017f577a24095b90
- MD5 1f775da4cf1a3a1834207e975a72e9d7
- SHA1 2026a1fcf8fa23654707d12a1e285a68d21aa9ff
- SHA512 23567c1cd17ef7f6a16e135717e038db2a631edba99ca8e4eb7c6c17854b8b34cde44527ef1c492e650770868d74b0d2044e7ed73a6802989252af23e854ceb5
- SSDEEP 3072:8wrTLwJkzq7in2jK8hMI4bYxYAOtKxSbLhfjs9L/xkgOs:1r/Aig+5ZbYxYA+KxoF4ZR
- TLSH
  T127044C05E29564F9E8BBC1789EE6535BFBB1380E172496DB1170CA547F03AE4AB7C308
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/².docx
- Size 172KB
- SHA256 fbe7c3b6483ad723adc304a3e36cb4c0b5fa94fab1f975b7649ba4e70c220ef3
- MD5 f23585b37977925067aa18f3e02d2619
- SHA1 f4fed5c1cd1bb5d297c29e62db37d4e873f7ddf2
- SHA512 237d3155f6446ba4ce2e14d3cc71b15b5038a94ccba471cbdf41060ac12f5ca28fe4f425f4317c9d10952c17948c9fb212d435c1ee98b420e2a9104891087b0a
- SSDEEP 3072:d4g86sd8cUP1t3/poITtgvsq0LkDudYnW2+kZYbOQLUfp4Ia9rlRf:Gg+dpUPX/pdTtgkpLkDuSWbkZYlop92r
- TLSH
  T18904E067D815CD52C2F94179B1C38144C83A98A8E7BEE035CCA36DE9F2ECFC932151A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  CDC驱动/WIN7安装CDC驱动方法.pdf
- Size 279KB
- SHA256 ee614655017c21b50a3d7fbf8a17a9130bbcfc041de7a47530c186cf5f47ca37
- MD5 4bdc028e5e5c960fef68bac1fefffb2d
- SHA1 950867b708c3c93932a33602530cb75b73c7e49d
- SHA512 691a887859aeca9aee54b0e99245e7aee8403145df15f5299b9048da4c9f0f8f5fe6dba652d1bb68ae7f6205354d8d0be2efe2a7b2928362377ef2de265478b3
- SSDEEP 6144:NEbL55EFUBxeNVv4yP20ydQ671aQt/wkezVuWmmZ/xhiZAeT+w:NEbL55lxeT5P20GQ671QkezVuWmmZXij
- TLSH
  T12854223C9D32420AD95502F95AD96D0DB80EF1BFBCF9C816CACD868D8005997E75B3CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  USB /win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳ豸 ȱCDC£ذװ/CDC/WIN7װCDC.pdf
- Size 279KB
- SHA256 ee614655017c21b50a3d7fbf8a17a9130bbcfc041de7a47530c186cf5f47ca37
- MD5 4bdc028e5e5c960fef68bac1fefffb2d
- SHA1 950867b708c3c93932a33602530cb75b73c7e49d
- SHA512 691a887859aeca9aee54b0e99245e7aee8403145df15f5299b9048da4c9f0f8f5fe6dba652d1bb68ae7f6205354d8d0be2efe2a7b2928362377ef2de265478b3
- SSDEEP 6144:NEbL55EFUBxeNVv4yP20ydQ671aQt/wkezVuWmmZ/xhiZAeT+w:NEbL55lxeT5P20GQ671QkezVuWmmZXij
- TLSH
  T12854223C9D32420AD95502F95AD96D0DB80EF1BFBCF9C816CACD868D8005997E75B3CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  win10_64bit/ksthunk.sys
- Size 28KB
- SHA256 d717ce30ee9e1faaa59837e0755ed57fd76629aa28e241c23269bbbfc430ef0e
- MD5 7e3bedef17ffc3da9e2e306138c5250f
- SHA1 4f937ebd5283d80c61a421f331633f996f612f0e
- SHA512 52cef4527b165bb93322739515276f576a599cd8b7d2526e89030debd25a593f8b884b97c7be9cfe88c7a6ea6cc69542927bf478ea934aee6edfad621cb6eb1f
- SSDEEP 384:BO1I4riAsiDlnTqrp1DCz1Dh37gyPuQjkqWP2kx4qay+H+wf38WTXwWLO:gbsgsp1e5DV7gymwkvecBsc
- TLSH
  T1DED22A9CF2FA28DAE16AC13C86EA1296E7B1F831535257DF4150CA395E33DD0D835E20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  win10_64bit/usbvideo.sys
- Size 293KB
- SHA256 d68b9dd00ca0f2fcf257f9196bef73d2346fe6967f88d4f476fd09a675eb3812
- MD5 369b1e5b2b2cd45f62cbcbb83c9d2e77
- SHA1 6c2d4a2df7722a92c8c92027326c7663a217f5c2
- SHA512 20cacde80277564171687447201c18218bc198b2ce9cf35fd4bb2f5ce5fe8560d989a6eade21153bffac0e71227962e2cdc466c41a4ee5a70849e87f37e0b4c6
- SSDEEP 6144:P3v30U4w00E3uSI7QM1qamycIAMkIuxYwHRsDn31AiHmQfKYPu/Pnpv+J:H30U4aE3uSISYcUmQfKYPuHQJ
- TLSH
  T166545C1DF3691CB4D4E6C074ADA65119ABB13C171B62E6DB10B0C978BF03ED8B978728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit/ksthunk.sys
- Size 28KB
- SHA256 d717ce30ee9e1faaa59837e0755ed57fd76629aa28e241c23269bbbfc430ef0e
- MD5 7e3bedef17ffc3da9e2e306138c5250f
- SHA1 4f937ebd5283d80c61a421f331633f996f612f0e
- SHA512 52cef4527b165bb93322739515276f576a599cd8b7d2526e89030debd25a593f8b884b97c7be9cfe88c7a6ea6cc69542927bf478ea934aee6edfad621cb6eb1f
- SSDEEP 384:BO1I4riAsiDlnTqrp1DCz1Dh37gyPuQjkqWP2kx4qay+H+wf38WTXwWLO:gbsgsp1e5DV7gymwkvecBsc
- TLSH
  T1DED22A9CF2FA28DAE16AC13C86EA1296E7B1F831535257DF4150CA395E33DD0D835E20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/win10_64bit/usbvideo.sys
- Size 293KB
- SHA256 d68b9dd00ca0f2fcf257f9196bef73d2346fe6967f88d4f476fd09a675eb3812
- MD5 369b1e5b2b2cd45f62cbcbb83c9d2e77
- SHA1 6c2d4a2df7722a92c8c92027326c7663a217f5c2
- SHA512 20cacde80277564171687447201c18218bc198b2ce9cf35fd4bb2f5ce5fe8560d989a6eade21153bffac0e71227962e2cdc466c41a4ee5a70849e87f37e0b4c6
- SSDEEP 6144:P3v30U4w00E3uSI7QM1qamycIAMkIuxYwHRsDn31AiHmQfKYPu/Pnpv+J:H30U4aE3uSISYcUmQfKYPuHQJ
- TLSH
  T166545C1DF3691CB4D4E6C074ADA65119ABB13C171B62E6DB10B0C978BF03ED8B978728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  win10 64λϵͳUVCºװ˵/WIN10ϵͳUVC/²(1).docx
- Size 172KB
- SHA256 fbe7c3b6483ad723adc304a3e36cb4c0b5fa94fab1f975b7649ba4e70c220ef3
- MD5 f23585b37977925067aa18f3e02d2619
- SHA1 f4fed5c1cd1bb5d297c29e62db37d4e873f7ddf2
- SHA512 237d3155f6446ba4ce2e14d3cc71b15b5038a94ccba471cbdf41060ac12f5ca28fe4f425f4317c9d10952c17948c9fb212d435c1ee98b420e2a9104891087b0a
- SSDEEP 3072:d4g86sd8cUP1t3/poITtgvsq0LkDudYnW2+kZYbOQLUfp4Ia9rlRf:Gg+dpUPX/pdTtgkpLkDuSWbkZYlop92r
- TLSH
  T18904E067D815CD52C2F94179B1C38144C83A98A8E7BEE035CCA36DE9F2ECFC932151A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  win7 32λ64λϵͳUVCºװ˵/WIN 7 װ֮ǰȷϵϵͳ.docx
- Size 315KB
- SHA256 514f606abd07575d2b81d11b1c5f27c831d12754f79281b72b65e31835420873
- MD5 4746583426c1bf63406303c09905ce7f
- SHA1 dc886388c0951232b3f567e2975ae3957e6f5936
- SHA512 1f3c16fb7f124277153acfec295123274aa68d136bfba60b6d968c915ba8918b54ec6e1e604d388adcf6c34bcc7264a6344748d6e552bac4f7420623a834ef33
- SSDEEP 6144:ziUxyfF42u8hFuzwP1FKuCaumGykQiWGI8iZIVPZE0Mbg8FvSeDVEdbb+4l:fxqu/sPzumGykQsOsFMbg8oeBEdbb+4l
- TLSH
  T17364F0B3D0B43033C8B6CE7C5C4927493D3A5CA950BEAA65DAC97D8D262F1ED294344E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  win7 32λ64λϵͳUVCºװ˵/WIN7ϵͳUVC/usbvideo.inf_x86_neutral/usbvideo.sys
- Size 142KB
- SHA256 12f1abdd5c871147afc682bcef099f319a4f542ac3f0b647d7a5dfe63edae061
- MD5 f642a7e4bf78cfa359cca0a3557c28d7
- SHA1 c59d6d66ad63b6f059473229832ca87eb769cca6
- SHA512 1fbe2bba439a96dffaa947f336229f368c7e01f49877803319dc55579778bdd15c63e1bdbf03af9397bc580672cb88c179f3e801730f6cf24c9cc7348565c7ea
- SSDEEP 3072:Cep5wyDz2/ZdSPq9ZhNuUMa8AiWkqKaQOl3FVBE8wNt9:R7a/SPqTvFknaQOl3bBO
- TLSH
  T1C8E3C636B05045F6D8A723B4524EB276EE5EE0EC1B1AF7E740A00FE47A68EC14D35786
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  usbvideo.inf_x86_neutral/usbvideo.sys
- Size 142KB
- SHA256 12f1abdd5c871147afc682bcef099f319a4f542ac3f0b647d7a5dfe63edae061
- MD5 f642a7e4bf78cfa359cca0a3557c28d7
- SHA1 c59d6d66ad63b6f059473229832ca87eb769cca6
- SHA512 1fbe2bba439a96dffaa947f336229f368c7e01f49877803319dc55579778bdd15c63e1bdbf03af9397bc580672cb88c179f3e801730f6cf24c9cc7348565c7ea
- SSDEEP 3072:Cep5wyDz2/ZdSPq9ZhNuUMa8AiWkqKaQOl3FVBE8wNt9:R7a/SPqTvFknaQOl3bBO
- TLSH
  T1C8E3C636B05045F6D8A723B4524EB276EE5EE0EC1B1AF7E740A00FE47A68EC14D35786
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Bdaejec Backdoor.

Family: Bdaejec

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32