Overview

overview

10

Static

static

BROWSER_.exe

windows7-x64

10

BROWSER_.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Browser_renew.iso

  • Size

    35.9MB

  • Sample

    221020-24jjlaaebm

  • MD5

    7a286d02dc8da557b740eaea28235cac

  • SHA1

    cf04227323e97c5333bbb6704661e7f48214db6c

  • SHA256

    76b3d17196dd9e99eadd46e8bc760ec8809a0c723f66fb687ab8576dd1299e34

  • SHA512

    01aea46ee977781039489fa09105ddd44280b9e828f33c46eddd5ba2fa9c1e1da9f657328a73de7c09801fcb89621e326d5696fb6631f2d9a7510eef40c6af53

  • SSDEEP

    786432:MQRwdPcRZMRDY8X9XRTuCpZD7U4qRVOtIqNi0f9jphU7oDM8ETp9an3aZ:zRwdPcRZuDYg1pZfUNRctpNi0f9dhU7L

Score
10/10
babadedanetsupportcrypterevasionloaderpersistencerattrojan

Malware Config

Targets

    • Target

      BROWSER_.EXE

    • Size

      35.1MB

    • MD5

      edde1633579f5e1f0543140cfbfa50fb

    • SHA1

      4233ff7941da62b86fc2c2d92be0572c9ab534c8

    • SHA256

      23b14288d49610a8eef61977b7fc49a963f1261fe29b1668b4443a04eaf493cb

    • SHA512

      e03a1575824ea04d30e3c3290d87e73be689014970e94ddc56f157766bc048faa5129e4589be0b8a404ce75c0fdf4301973c21cb5593a9c6006f26709507bf5c

    • SSDEEP

      786432:SQRwdPcRZMRDY8X9XRTuCpZD7U4qRVOtIqNi0f9jphU7oDM8ETp9an3aZO:1RwdPcRZuDYg1pZfUNRctpNi0f9dhU7a

    Score
    10/10
    babadedanetsupportcrypterevasionloaderpersistencerattrojan

    • Babadeda

      Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

      loadercrypterbabadeda

    • Babadeda Crypter

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks