babadeda

General

Target

e1c5e17d90f580bbcb8cf99dc5d696f9b5c4cf45789617de77a350e101b79214
Size

11.7MB
Sample

221127-awsnrafh98
MD5

0f887c61e1b11623374401f9ffb48bad
SHA1

760321c5710f4040ef74ffbd2ec63244143be11a
SHA256

e1c5e17d90f580bbcb8cf99dc5d696f9b5c4cf45789617de77a350e101b79214
SHA512

448cfcc8e5366164b9a950854217cd0a8a1dc99329d6e048a1246a5d03f97dbd311b52876f9003a51d19be1eaa34204e15f67b36d86490905cb873633c5f1340
SSDEEP

196608:S2J/5wdPGb3R3etNv9jpuSrsR3gp276tQhMnfxSvmN6TbSLjuOG+VL9hAlw9fhcn:SQ/5wdPcRkVrsRQp276trfBN6T++ORKj

Score

10^/10

Malware Config

Targets

- Target
  
  e1c5e17d90f580bbcb8cf99dc5d696f9b5c4cf45789617de77a350e101b79214
- Size
  
  11.7MB
- MD5
  
  0f887c61e1b11623374401f9ffb48bad
- SHA1
  
  760321c5710f4040ef74ffbd2ec63244143be11a
- SHA256
  
  e1c5e17d90f580bbcb8cf99dc5d696f9b5c4cf45789617de77a350e101b79214
- SHA512
  
  448cfcc8e5366164b9a950854217cd0a8a1dc99329d6e048a1246a5d03f97dbd311b52876f9003a51d19be1eaa34204e15f67b36d86490905cb873633c5f1340
- SSDEEP
  
  196608:S2J/5wdPGb3R3etNv9jpuSrsR3gp276tQhMnfxSvmN6TbSLjuOG+VL9hAlw9fhcn:SQ/5wdPcRkVrsRQp276trfBN6T++ORKj
Score

10^/10

babadeda crypter evasion loader persistence trojan
- Babadeda
  Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
  loader crypter babadeda
- Babadeda Crypter
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Babadeda Crypter

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2