Arsenal-237 New Files: BdApiUtil64.sys (Vulnerable Baidu Driver) — Indicators

29 shown

Type	Indicator
ipv4	`109.230.231.37`
sha256	`47ec51b5f0ede1e70bd66f3f0152f9eb536d534565dbb7fcc3a05f542dbe4428`
sha1	`148c0cde4f2ef807aea77d7368f00f4c519f47ef`
sha1	`65439929b67973eb192d6ff243e6767adf0834e4`
md5	`ced47b89212f3260ebeb41682a4b95ec`
path	`C:\Program Files\CrowdStrike\*.conf`
path	`C:\Program Files\ESET\*.xml`
path	`C:\Program Files\Kaspersky Lab\*.cfg`
path	`C:\Program Files\Windows Defender\*.config`
path	`C:\ProgramData\BdApiUtil64.sys`
path	`C:\ProgramData\Microsoft\Credentials\* (Stored credentials)`
path	`C:\ProgramData\Microsoft\Crypto\*`
path	`C:\ProgramData\WindowsUpdater.exe`
path	`C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Login Data`
path	`C:\Users\*\AppData\Local\Microsoft\Edge\User Data\Default\Login Data`
path	`C:\Users\\AppData\Local\Mozilla\Firefox\Profiles\\logins.json`
path	`C:\Users\\AppData\Roaming\Microsoft\Credentials\ (User credentials)`
path	`C:\Users\\AppData\Roaming\Microsoft\Crypto\RSA\`
path	`C:\Windows\System32\Microsoft\Protect\*`
path	`C:\Windows\System32\config\SAM (Windows user credentials)`
path	`C:\Windows\System32\config\SYSTEM (System credentials)`
path	`C:\Windows\System32\drivers\BdApiUtil64.sys`
path	`C:\Windows\Temp\BdApiUtil64.sys`
path	`C:\Windows\Temp\agent.exe`
path	`D:\jenkins\workspace\bav_5.0_workspace\BavOutput\Pdb\Release\BdApiUtil64.pdb`
registry	`HKLM\SOFTWARE\Policies (security policies)`
registry	`HKLM\SYSTEM\CurrentControlSet\Services (service configuration)`
registry	`HKLM\SYSTEM\CurrentControlSet\Services\Bprotect`
filename	`bdapiutil64.sys`

40 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.