Overview

overview

10

Static

static

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Resubmissions

27-11-2022 00:34

221127-awsnrafh98 10

26-11-2022 22:21

221126-194ahsdb41 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1c5e17d90f580bbcb8cf99dc5d696f9b5c4cf45789617de77a350e101b79214

  • Size

    11.7MB

  • Sample

    221126-194ahsdb41

  • MD5

    0f887c61e1b11623374401f9ffb48bad

  • SHA1

    760321c5710f4040ef74ffbd2ec63244143be11a

  • SHA256

    e1c5e17d90f580bbcb8cf99dc5d696f9b5c4cf45789617de77a350e101b79214

  • SHA512

    448cfcc8e5366164b9a950854217cd0a8a1dc99329d6e048a1246a5d03f97dbd311b52876f9003a51d19be1eaa34204e15f67b36d86490905cb873633c5f1340

  • SSDEEP

    196608:S2J/5wdPGb3R3etNv9jpuSrsR3gp276tQhMnfxSvmN6TbSLjuOG+VL9hAlw9fhcn:SQ/5wdPcRkVrsRQp276trfBN6T++ORKj

Score
10/10
babadedacrypterevasionloaderpersistencetrojan

Malware Config

Targets

    • Target

      e1c5e17d90f580bbcb8cf99dc5d696f9b5c4cf45789617de77a350e101b79214

    • Size

      11.7MB

    • MD5

      0f887c61e1b11623374401f9ffb48bad

    • SHA1

      760321c5710f4040ef74ffbd2ec63244143be11a

    • SHA256

      e1c5e17d90f580bbcb8cf99dc5d696f9b5c4cf45789617de77a350e101b79214

    • SHA512

      448cfcc8e5366164b9a950854217cd0a8a1dc99329d6e048a1246a5d03f97dbd311b52876f9003a51d19be1eaa34204e15f67b36d86490905cb873633c5f1340

    • SSDEEP

      196608:S2J/5wdPGb3R3etNv9jpuSrsR3gp276tQhMnfxSvmN6TbSLjuOG+VL9hAlw9fhcn:SQ/5wdPcRkVrsRQp276trfBN6T++ORKj

    Score
    10/10
    babadedacrypterevasionloadertrojanpersistence

    • Babadeda

      Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

      loadercrypterbabadeda

    • Babadeda Crypter

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks