babadeda

General

Target

7eb1b46c43a2290eb2631ea061da7258591e37da9f784e9dc890f1a27d292d9e
Size

5.8MB
Sample

220228-xccjragcgj
MD5

114daaf4ec2fa86c801300439044d946
SHA1

9da80d1bed43da4c74f4a0957a580d4e7839f434
SHA256

7eb1b46c43a2290eb2631ea061da7258591e37da9f784e9dc890f1a27d292d9e
SHA512

ec9333ab61e3e61b4c373dc349d8ecff7145c6bc59b409b658ea2bd2c45ad441ce1a121ac9515764c8c2d2642c5175b8ca6d40328cf84f700dd156e2fbaeb8e0

Score

10^/10

Malware Config

Targets

- Target
  
  7eb1b46c43a2290eb2631ea061da7258591e37da9f784e9dc890f1a27d292d9e
- Size
  
  5.8MB
- MD5
  
  114daaf4ec2fa86c801300439044d946
- SHA1
  
  9da80d1bed43da4c74f4a0957a580d4e7839f434
- SHA256
  
  7eb1b46c43a2290eb2631ea061da7258591e37da9f784e9dc890f1a27d292d9e
- SHA512
  
  ec9333ab61e3e61b4c373dc349d8ecff7145c6bc59b409b658ea2bd2c45ad441ce1a121ac9515764c8c2d2642c5175b8ca6d40328cf84f700dd156e2fbaeb8e0
Score

10^/10

babadeda phobos crypter evasion loader persistence ransomware spyware stealer
- Babadeda
  Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
  loader crypter babadeda
- Babadeda Crypter
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Blocklisted process makes network request
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2