Extracted

• • Target

    dd5f6a8a3f255be6e5b8c7402be7059298bcfea15931752e10ea0be59ad08063

  • Size

    6.3MB

  • MD5

    c14316961ed51ed35f6d8370d31aef56

  • SHA1

    7bd286d33c0b07b97635340a681eb8c62dec22cd

  • SHA256

    dd5f6a8a3f255be6e5b8c7402be7059298bcfea15931752e10ea0be59ad08063

  • SHA512

    923709d7c6ba6fc53af91833286b037a5c5fcc4bf7a4d779d0863e1147c69551f6552a4dc9223e3fbffa21fafac6948d4a1f21783e92a645d0cdce59fe311ea0

  Score

  10^/10

  babadedacryptbotcrypterloaderspywarestealer

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda

  • Babadeda Crypter

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2