Overview

overview

8

Static

static

GOLAYA-BABE.exe

windows7-x64

8

GOLAYA-BABE.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e7088e2533991c535d7f5f3d9f435c63732d3ccb4b4da23ca1b57773cb5c621

  • Size

    111KB

  • Sample

    220919-re9pdagacl

  • MD5

    385a44685595db8f24e46b195e802ebf

  • SHA1

    dc99d0888ec06fb2bb08fdc7dfd38813b7280428

  • SHA256

    5e7088e2533991c535d7f5f3d9f435c63732d3ccb4b4da23ca1b57773cb5c621

  • SHA512

    62e220fa61608d17555cca4abbbdd8998f6fc3416336935098a5c805542fa80ef68e0d393acef539ab4717e0e8836934b041164d7e6ab89d258810f970388344

  • SSDEEP

    3072:vl0img13tG90HdQ3Sqt9YacAHRmpuf32KAj4S9vt:vljpD9Q3Tt9Sp4ovt

Score
8/10
discovery

Malware Config

Targets

    • Target

      GOLAYA-BABE.exe

    • Size

      239KB

    • MD5

      9932b8424ae1bc1663264d490bddf2ac

    • SHA1

      7d0ae571d6b5d549d81e8490d9345caae621b912

    • SHA256

      83cbcd25b74ebb00e5bee3d97b1152469d662b35e224f892b5456bbf7d529196

    • SHA512

      070214beaccada100d55d83b11cb7c749a509c9b95a781828acef32bf76ac06fe6382b8020c258d5ca750be6fb0548f826bf4d925cd3604f80d9f8b7624f5c9c

    • SSDEEP

      3072:XBAp5XhKpN4eOyVTGfhEClj8jTk+0hgd5rY4J9UqztfJ4t0873l8ACHxDgeTmzgA:abXE9OiTGfhEClq9Td5roJJUK

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks