General
-
Target
Cloudflare_security_install.exe
-
Size
34.4MB
-
Sample
220915-nkeveagfar
-
MD5
e3763ad6ab1f66bfd0240db96ccdc0be
-
SHA1
523be6fdb9b5740146f5d24b17193cf62ff4c35f
-
SHA256
bad534540ed575c213bd34fe1f21c6ffca58169e9c9c83669749c3f6e398ea4b
-
SHA512
7c2e67ec3652dc2e38c33852720a023606a7dd0f699f7c03e263c845c88c4175b53826bc61ba44d74e2a793391ef32f653e7cbf427d2ad2d9e75cede90208253
-
SSDEEP
786432:SQRwdPcR5MRDY8X9XRTuCpZD7U4qRVOtIqNi0f9jphU7oDM8ETp9a6KPih:1RwdPcR5uDYg1pZfUNRctpNi0f9dhU7r
Malware Config
Targets
-
-
Target
Cloudflare_security_install.exe
-
Size
34.4MB
-
MD5
e3763ad6ab1f66bfd0240db96ccdc0be
-
SHA1
523be6fdb9b5740146f5d24b17193cf62ff4c35f
-
SHA256
bad534540ed575c213bd34fe1f21c6ffca58169e9c9c83669749c3f6e398ea4b
-
SHA512
7c2e67ec3652dc2e38c33852720a023606a7dd0f699f7c03e263c845c88c4175b53826bc61ba44d74e2a793391ef32f653e7cbf427d2ad2d9e75cede90208253
-
SSDEEP
786432:SQRwdPcR5MRDY8X9XRTuCpZD7U4qRVOtIqNi0f9jphU7oDM8ETp9a6KPih:1RwdPcR5uDYg1pZfUNRctpNi0f9dhU7r
Score10/10-
Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
-
Babadeda Crypter
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Registers COM server for autorun
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-