Overview

overview

8

Static

static

3

GOLAYA-BABE.exe

windows7-x64

8

GOLAYA-BABE.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    72e3941fb451209d267530b798dfcce0

  • Size

    86KB

  • Sample

    231226-qx9awsadgp

  • MD5

    72e3941fb451209d267530b798dfcce0

  • SHA1

    0594034fdb884f64feee0236c039bd9ff9ed8f24

  • SHA256

    9dcf9f64acf46aeec598d246fbb361dac3a7a7b3ff92fafc87b020c8eca6758c

  • SHA512

    db202b8e31079d93792bc07a6f1d4ff31fd5848f3564352e3e666ff539aadad78188a670c8f4b583fd07a70cf4ebd9d4cecccb926f61ce7fd1b4e706889854ee

  • SSDEEP

    1536:vlfbwimgTY23tG90wIsWfHlWKSd+QSqWU5FdCmCWuKw6kS+AJtBcg9HGULnQxYyX:vl0img13tG90HdQ3SqtRjCT7fmJtBfQ5

Score
8/10

Malware Config

Targets

    • Target

      GOLAYA-BABE.exe

    • Size

      181KB

    • MD5

      3f0da76b4c682e86aeb9a8a425eaa903

    • SHA1

      650b36332381beac233426a3fb4bfeaca92a1296

    • SHA256

      ffa647bd5ec34f2f982bd2695abf1be734d323b66617c9e7f8bdaed49832ec6e

    • SHA512

      29010590d712e329c322430340c3cd28c88d7242fefebe0f404c04f7eb703351b27c5faf01771259bb768c1ed7d14cf1730f626a372754d6579b91656bdc4c92

    • SSDEEP

      3072:YBAp5XhKpN4eOyVTGfhEClj8jTk+0hD+iG+v5y1rF0t8:PbXE9OiTGfhEClq9iktFb

    Score
    8/10

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks