General

  • Target

    5978ee8fc33a5f8ee35731e3ed54d4dc.exe

  • Size

    25.1MB

  • Sample

    220921-h1xghaffe9

  • MD5

    5978ee8fc33a5f8ee35731e3ed54d4dc

  • SHA1

    fdd2b31bbf3320d31aa3eb6e67eada9d15bc88fb

  • SHA256

    10cb4b192833f0670c4ec6fa05898ac776862e22d7370787d6ddb915b7777bdb

  • SHA512

    db7516ac7a4b40bc418ff1607b54939349d5a8f0b751dd499f00a42cd10800fb41bffea4c2e32085af723ef89fc82b2111f86ef6cbd4ee14382f2505fae3d1fe

  • SSDEEP

    786432:MHwiu9WM+JVjjS++8yOvSAoeykWVLI5+YDmdc4s:MHwvWnJVjjptvToeykWV851Cw

Malware Config

Targets

    • Target

      5978ee8fc33a5f8ee35731e3ed54d4dc.exe

    • Size

      25.1MB

    • MD5

      5978ee8fc33a5f8ee35731e3ed54d4dc

    • SHA1

      fdd2b31bbf3320d31aa3eb6e67eada9d15bc88fb

    • SHA256

      10cb4b192833f0670c4ec6fa05898ac776862e22d7370787d6ddb915b7777bdb

    • SHA512

      db7516ac7a4b40bc418ff1607b54939349d5a8f0b751dd499f00a42cd10800fb41bffea4c2e32085af723ef89fc82b2111f86ef6cbd4ee14382f2505fae3d1fe

    • SSDEEP

      786432:MHwiu9WM+JVjjS++8yOvSAoeykWVLI5+YDmdc4s:MHwvWnJVjjptvToeykWV851Cw

    • Babadeda

      Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    • Babadeda Crypter

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v6

Tasks