Overview

overview

10

Static

static

Browser_renew.exe

windows7-x64

7

Browser_renew.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Browser_renew.exe

  • Size

    35.1MB

  • Sample

    221020-s9zy4acaar

  • MD5

    edde1633579f5e1f0543140cfbfa50fb

  • SHA1

    4233ff7941da62b86fc2c2d92be0572c9ab534c8

  • SHA256

    23b14288d49610a8eef61977b7fc49a963f1261fe29b1668b4443a04eaf493cb

  • SHA512

    e03a1575824ea04d30e3c3290d87e73be689014970e94ddc56f157766bc048faa5129e4589be0b8a404ce75c0fdf4301973c21cb5593a9c6006f26709507bf5c

  • SSDEEP

    786432:SQRwdPcRZMRDY8X9XRTuCpZD7U4qRVOtIqNi0f9jphU7oDM8ETp9an3aZO:1RwdPcRZuDYg1pZfUNRctpNi0f9dhU7a

Score
10/10
babadedanetsupportcrypterevasionloaderpersistencerattrojan

Malware Config

Targets

    • Target

      Browser_renew.exe

    • Size

      35.1MB

    • MD5

      edde1633579f5e1f0543140cfbfa50fb

    • SHA1

      4233ff7941da62b86fc2c2d92be0572c9ab534c8

    • SHA256

      23b14288d49610a8eef61977b7fc49a963f1261fe29b1668b4443a04eaf493cb

    • SHA512

      e03a1575824ea04d30e3c3290d87e73be689014970e94ddc56f157766bc048faa5129e4589be0b8a404ce75c0fdf4301973c21cb5593a9c6006f26709507bf5c

    • SSDEEP

      786432:SQRwdPcRZMRDY8X9XRTuCpZD7U4qRVOtIqNi0f9jphU7oDM8ETp9an3aZO:1RwdPcRZuDYg1pZfUNRctpNi0f9dhU7a

    Score
    10/10
    evasiontrojanbabadedanetsupportcrypterloaderpersistencerat

    • Babadeda

      Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

      loadercrypterbabadeda

    • Babadeda Crypter

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks