Extracted

• • Target

    DriverDiagnoseTool.exe

  • Size

    300.9MB

  • MD5

    d70de5a533c758bcba7ff16d204cdbe6

  • SHA1

    38d9f39f8c3699c04c4e4ba3e33afbed745e3e8f

  • SHA256

    40d348783300d039d969f27a22433a8cba8d31c28e2e8d542c10a5792d34c1d3

  • SHA512

    a9355532ad9310a61f1b07926a64d48669ebf3e15e45c18a28a7b16c3e94d66037752d45b36e26c2dbb247b2d9fdcedc18f00fb4229daece372f44af418c07f1

  • SSDEEP

    6291456:vz2C0PyE4M6Q1nYOCNxklwFy3kMj/2Lk6T8yV3hVJC45EHbzwIgjx:KC0PyE4M6Q1bMxTFy3r7d6T8y72HZk

  Score

  10^/10

  babylonrattrojanupx

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2

• • Target

    KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.lnk

  • Size

    3KB

  • MD5

    67919ac65f71daac11a70f8d9e9b75d3

  • SHA1

    0ce2c4fe931dc3e711ea4af9913476a4e08fc7b2

  • SHA256

    2c202c8fb88c907867f43a1d3c82a15b3b67204799efaed9e5cca2e150cdaacc

  • SHA512

    c235a6a0913da127b70a46491e51d47813a3a7edcfcae6e1bcf1a06ccc418eb304ed05062fd6c84215533f8b30aea4e6dd3f59ad7c2b4ff2f9aab1a93914c533

  Score

  10^/10

  babylonratpersistencetrojanupx

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral3behavioral4

• • Target

    KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.pdf

  • Size

    49.2MB

  • MD5

    b02c8bb71a223c4fd1d199638ee01ba0

  • SHA1

    33b4cb8ce9483e14476fb2b75d948ebb1ba04480

  • SHA256

    fa53b9ffeac9ab9957ff64bf7c5484b570442e183ac6509bb01f7fd6dbcd0b4d

  • SHA512

    f9eb7cb7d9da46a6780154750da61adbbcd37d62a76f133629fb8d9be6bf56215185191962e78d3b35ff10cd2b6cead6f327e622bcd2067cde11c8e213259e1a

  • SSDEEP

    786432:kM7WBbW/hcVBAizVaTLGer0UClobCG20Fl1k7iCvRbSqb5k1iulJl7wEp5rBgvBL:57v/hExzUHaReVTf1cbSqVYlH8IiBVUq

  Score

  1^/10
  behavioral5behavioral6

• • Target

    KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.ps1

  • Size

    665B

  • MD5

    6fb15b95d7c72e3ccbc83b37a41b45d4

  • SHA1

    c5d8e777be55d08aeff6e3ab40b7768e446b5801

  • SHA256

    36e08d17fb61edfd642fa968a62dcdd23c20952d9ac4550bb8e36ec908aff38b

  • SHA512

    7f2072d027012ce27145787f3a2948f6f95bfccf0527ee444cd328243b0e18004bffe798320810ede91a02d38e0863a97248e376b15a75a6c763494fb06826c6

  Score

  10^/10

  babylonratpersistencetrojanupx

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral7behavioral8