Overview

overview

8

Static

static

GOLAYA-BABE.exe

windows7-x64

8

GOLAYA-BABE.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    7dff8e4627e28b1717fca4223ffe90655bab82b1e5c07e691dca6989e542d9d0

  • Size

    111KB

  • Sample

    221203-a46wcaaf37

  • MD5

    0ee299805820247a44fabf8b54f51c10

  • SHA1

    6d1d6b48d3dc784b15ad014b23d59b8b04eb07ad

  • SHA256

    7dff8e4627e28b1717fca4223ffe90655bab82b1e5c07e691dca6989e542d9d0

  • SHA512

    445bbb59e09f2381c5a2d65fc2b85d9223136b27508269567f705bc0cc2c6df522cf43ac856c17467f133eaccf5b83342a148af0cc24cdf543d7c5aba8dfab0f

  • SSDEEP

    3072:1l0img13tG90HdQ3Sqt9YacAHRmpuf32KAj4S9vH:1ljpD9Q3Tt9Sp4ovH

Score
8/10
discovery

Malware Config

Targets

    • Target

      GOLAYA-BABE.exe

    • Size

      239KB

    • MD5

      9932b8424ae1bc1663264d490bddf2ac

    • SHA1

      7d0ae571d6b5d549d81e8490d9345caae621b912

    • SHA256

      83cbcd25b74ebb00e5bee3d97b1152469d662b35e224f892b5456bbf7d529196

    • SHA512

      070214beaccada100d55d83b11cb7c749a509c9b95a781828acef32bf76ac06fe6382b8020c258d5ca750be6fb0548f826bf4d925cd3604f80d9f8b7624f5c9c

    • SSDEEP

      3072:XBAp5XhKpN4eOyVTGfhEClj8jTk+0hgd5rY4J9UqztfJ4t0873l8ACHxDgeTmzgA:abXE9OiTGfhEClq9Td5roJJUK

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks