babadeda

General

Target

CLF_security.zip
Size

33.4MB
Sample

221023-w71z6abhbq
MD5

3de490174162e430fa4da15bf43d7cf6
SHA1

b77cb05af5fc467ad266a9393bbaa69482b6a5dd
SHA256

8b82cb03647b6123ec1b5d38dbc1c6b5714bd1ccc543840cb9080bca470d2a7d
SHA512

d0f14edc3a595e590635c98f6d477535aed7e8354290de7c5727fd73b6af1dcae9fd0b7b7d93a862494115b9a7e06d049979376149436516f3c8ebf625c87e3c
SSDEEP

786432:D1eVa1a+adKYUNlbetLl4WFqTr7xPpkFp+MMRSIRBFw83C4A:DcVJGzbetLl4UqT/xPGFp+MMRvC4A

Score

10^/10

Malware Config

Targets

- Target
  
  CLFsecurity.exe
- Size
  
  35.1MB
- MD5
  
  edde1633579f5e1f0543140cfbfa50fb
- SHA1
  
  4233ff7941da62b86fc2c2d92be0572c9ab534c8
- SHA256
  
  23b14288d49610a8eef61977b7fc49a963f1261fe29b1668b4443a04eaf493cb
- SHA512
  
  e03a1575824ea04d30e3c3290d87e73be689014970e94ddc56f157766bc048faa5129e4589be0b8a404ce75c0fdf4301973c21cb5593a9c6006f26709507bf5c
- SSDEEP
  
  786432:SQRwdPcRZMRDY8X9XRTuCpZD7U4qRVOtIqNi0f9jphU7oDM8ETp9an3aZO:1RwdPcRZuDYg1pZfUNRctpNi0f9dhU7a
Score

10^/10

babadeda netsupport crypter discovery evasion loader persistence rat spyware stealer trojan
- Babadeda
  Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
  loader crypter babadeda
- Babadeda Crypter
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Registers COM server for autorun
  persistence
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2