Overview

overview

8

Static

static

GOLAYA-BABE.exe

windows7-x64

8

GOLAYA-BABE.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97d2d749cf08d9b803c08ef30f18663ce4187a2aeffd19d6706922682b7357b5

  • Size

    119KB

  • Sample

    220919-bqck1sechn

  • MD5

    7f94a53767e65b83f4e513dc84144f7c

  • SHA1

    c74d6012ee2e2522ecb0b463b7a2b16d7ca0d69e

  • SHA256

    97d2d749cf08d9b803c08ef30f18663ce4187a2aeffd19d6706922682b7357b5

  • SHA512

    0e8367c04fb24ef3942c351b387cdc7c6f7b37cd81c7825e26a1b78a0958b1cce1e28be5b62fab60db47df27dcae0f43f50c2d4d7ee150b6ced7cef23255574a

  • SSDEEP

    3072:3rz/BRg1SR31UMrsj1BzoAGuw0bNtMPHS5Z+aQQ:3P/BRg1SR31UMq+v0bzMPHGx

Score
8/10
discovery

Malware Config

Targets

    • Target

      GOLAYA-BABE.exe

    • Size

      239KB

    • MD5

      22c9f0d7dfadf25b221bee4d6fe9c39f

    • SHA1

      171e6a865624222ae347d828a2a415a243c05951

    • SHA256

      bc604cfca1473eb7ceb590689348f5a840a6e9425319e9ef120a893390345c58

    • SHA512

      352265ba2ced7b5a6c2ee82f4fbf4788bf20a840684e827c548792e814f191da6be20b820bc8eebd77cfd27880904018cdc8ee5a54893e7eedd27e1cd196eee1

    • SSDEEP

      3072:kBAp5XhKpN4eOyVTGfhEClj8jTk+0hM3GRjDNOoCya+Cgw5CKH2:zbXE9OiTGfhEClq9EjQKJJU2

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks