Extracted

• • Target

    cf88923b7d0287884870af999a8d64f90c7deeb4c4d09feed406472ff259b30d.exe

  • Size

    10.7MB

  • MD5

    60bce89d8df5caa28d3d73ee4c94313a

  • SHA1

    878e237aeb528a1e4c6c3fe53cb4ffd1c420231e

  • SHA256

    cf88923b7d0287884870af999a8d64f90c7deeb4c4d09feed406472ff259b30d

  • SHA512

    963629759df10731e7b49a113fd4eb462286d26d4b394bab89bea35f4515cc907d803b01313764b973ebd4876a40e2fff820ad6b10f7a142e74a31a836010665

  • SSDEEP

    196608:yxthehwzf4soekmmf7zADj75xtw0QkyPAm2VxdG1P5K5S2njugWR:meCBoeq7adK7JonCxC7juR

  Score

  10^/10

  babadedafickerstealercrypterinfostealerloader

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda

  • Babadeda Crypter

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2