Loading malware…
Bedep is a Windows malware downloader and modular ad-fraud botnet first observed around August 2014, with documented activity continuing into 2016. It is closely associated with the Angler exploit kit and was distributed through malvertising and compromised websites that redirected visitors to browser and plugin exploits. Campaigns used the Adobe Flash Player vulnerability CVE-2015-0311, including during its exploitation as a zero-day. Bedep was also observed in pseudo-Darkleech infection chains.
Bedep downloads and executes additional malware and can perform advertising and click fraud through a resident module. Observed secondary payloads include Pony, Vawtrak, Ursnif, Ramnit, Reactor Bot, and CryptXXX ransomware. It also participated in multi-stage infection chains delivering AbaddonPOS point-of-sale malware. Some variants execute directly in memory without dropping an executable, while disk-backed variants establish persistence through COM registration and run within the Windows Explorer process.
Bedep uses a domain generation algorithm seeded with European Central Bank foreign-exchange reference rates and UTC time data to locate command-and-control infrastructure. Its dependence on externally published exchange rates complicates advance prediction of future domains. It also performs virtualization and environment checks, including ACPI-related checks. Detected analysis environments can be diverted to decoy infrastructure and receive different payloads, concealing the infection behavior seen on ordinary systems.
Bedep supported financially motivated malware distribution and advertising fraud across geographically widespread Windows infections. Infrastructure research established close operational links between Bedep and Angler, but did not conclusively identify a named operator.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Back in the 0-Day Let's start a little more than a year ago with the Angler Flash 0-day (CVE-2015-0310)... It started a year ago with the Adobe Flash 0-Day that was incorporated into Angler (CVE-2015-0310). | Bedep is a malware downloader that is exclusive to Angler. This post will discuss the Bedep side of Angler and draw some pretty clear connections between Angler and Bedep.
Upon successful exploitation, we observed a new variant of the Bedep Trojan getting dropped and executed on the victim machine.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Bedep could be described as a fileless loader with a resident module that can optionally perform AdFraud.
After that, Bedep acts differently. You'll see Bedep contacting 95.211.205[.]228 after Bedep detects it's running on a VM, and it will download different malware. As usual, no CryptXXX ransomware when doing the Angler EK/Bedep infection with a VM, and any click-fraud traffic is a ruse.
After that, Bedep acts differently. You'll see Bedep contacting 95.211.205[.]228 after Bedep detects it's running on a VM, and it will download different malware. As usual, no CryptXXX ransomware when doing the Angler EK/Bedep infection with a VM, and any click-fraud traffic is a ruse.
Some resulting in Bedep not trying to contact the C&C, some where the positive check end up with a different seed for the Bedep DGA redirecting spotted machines in a dedicated instance.
You'll see Bedep contacting 95.211.205[.]228 after Bedep detects it's running on a VM, and it will download different malware.
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Bedep is a modular downloader and ad-fraud botnet known for using a highly sophisticated domain generation algorithm seeded with European Central Bank foreign exchange rates to hide and rotate its command-and-control infrastructure.
Malware in the Angler EK infection chain that performs post-infection network activity, shows VM-aware behavior, and can lead to delivery of CryptXXX on normal hosts while downloading different malware or click-fraud-related payloads when VM detection occurs.
Referenced as malware using a domain generation algorithm (DGA).
Bedep is referenced as another malware family with a DGA seeded from nondeterministic external data sources.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.