Overview

overview

8

Static

static

3

GOLAYA-BABE.exe

windows7-x64

8

GOLAYA-BABE.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    1721657abe3b91a1f5f718bbd775f991

  • Size

    110KB

  • Sample

    231224-2s6vragbfp

  • MD5

    1721657abe3b91a1f5f718bbd775f991

  • SHA1

    84b671041cdbd905a0189d20c417d0bc5d2a4e4c

  • SHA256

    40c1685dca2af6016b14ef2da187991fca01f50b7e15578877044eb6c99cfdd9

  • SHA512

    37329b2ce571f3178cc8a194bd2cb335d11816ef29239a7da09c8022be9ad44a198099dc76ed6f2f5873fb9c7bfb02fbd0ee83f5f18e422158e3d12c08a09bf8

  • SSDEEP

    3072:Orz/BRgFRo6WhIlNFxURW81akiszyNvvBPTHoIY5d03:OP/BRgFK6Wml7xURdIYkpTHofdM

Score
8/10
discovery

Malware Config

Targets

    • Target

      GOLAYA-BABE.exe

    • Size

      239KB

    • MD5

      fbf68a3b69a27d867baf3afa2cfe8998

    • SHA1

      316c1c73098768b6883c2378c3eee9c01e7d41df

    • SHA256

      4617d7f365df5e30a1152ee10d8f3589ea7bfaf885bc838b0faa7271e00c3f9b

    • SHA512

      807a01a429d657c68aa05054469e1be21af607f91c4b0aad2e1f9780718f0964873caef059f94dd2a72ef5c77b72af5175f46cb043105abfe96ba1dc2fe5756b

    • SSDEEP

      3072:MBAp5XhKpN4eOyVTGfhEClj8jTk+0hbe+s461efwvsOq7Mirevf0o3+2GFZB4Qy0:7bXE9OiTGfhEClq9uZJJUy

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks