babadeda

General

Target

a9fe45f68df07a631b9ffda604af62c5.exe
Size

38.1MB
Sample

221027-ctn9naachk
MD5

a9fe45f68df07a631b9ffda604af62c5
SHA1

47baf9832d6812906af41b57bea1337b03969c19
SHA256

4f6cb888a4dfade727490683feaee96679d7044f0181799c18a8c7060cb8dab3
SHA512

f6e6857788492e1cd0ce4d6da4d5c11f04efc65b7895e0da084f3cea1c2b4ec0267d04bd54885eb191ed31ebf16db02f120048201ee176a6de62dc790f56e367
SSDEEP

786432:WHwiu9WaDmAq9AHhIbznxWBEZ2FACXPyXXaDPgG1pvUybb2d00aHMGae:WHwvWAmAq9yhIPEBAC/yHg9YybSd00Q/

Score

10^/10

Malware Config

Targets

- Target
  
  a9fe45f68df07a631b9ffda604af62c5.exe
- Size
  
  38.1MB
- MD5
  
  a9fe45f68df07a631b9ffda604af62c5
- SHA1
  
  47baf9832d6812906af41b57bea1337b03969c19
- SHA256
  
  4f6cb888a4dfade727490683feaee96679d7044f0181799c18a8c7060cb8dab3
- SHA512
  
  f6e6857788492e1cd0ce4d6da4d5c11f04efc65b7895e0da084f3cea1c2b4ec0267d04bd54885eb191ed31ebf16db02f120048201ee176a6de62dc790f56e367
- SSDEEP
  
  786432:WHwiu9WaDmAq9AHhIbznxWBEZ2FACXPyXXaDPgG1pvUybb2d00aHMGae:WHwvWAmAq9yhIPEBAC/yHg9YybSd00Q/
Score

10^/10

babadeda netsupport crypter loader rat discovery evasion persistence trojan
- Babadeda
  Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
  loader crypter babadeda
- Babadeda Crypter
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2