Overview

overview

7

Static

static

3

Badlion Cl....1.exe

windows7-x64

4

Badlion Cl....1.exe

windows10-2004-x64

4

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDIR/app-64.7z

windows7-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

7

LICENSE.electron.txt

windows7-x64

1

LICENSE.electron.txt

windows10-2004-x64

1

chrome_100...nt.pak

windows7-x64

3

chrome_100...nt.pak

windows10-2004-x64

3

cursors/co...ze.cur

windows7-x64

3

cursors/co...ze.cur

windows10-2004-x64

3

cursors/co...ze.png

windows7-x64

3

cursors/co...ze.png

windows10-2004-x64

3

cursors/copy_drop.cur

windows7-x64

3

cursors/copy_drop.cur

windows10-2004-x64

3

cursors/hand_grab.png

windows7-x64

3

cursors/hand_grab.png

windows10-2004-x64

3

cursors/ha...ng.png

windows7-x64

3

cursors/ha...ng.png

windows10-2004-x64

3

cursors/link_drop.cur

windows7-x64

3

cursors/link_drop.cur

windows10-2004-x64

3

cursors/ro...ze.cur

windows7-x64

3

cursors/ro...ze.cur

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    Badlion Client Setup 4.0.1.exe

  • Size

    106.0MB

  • Sample

    240114-eyks5sbhhr

  • MD5

    903bd9351b62bc7cbe2557da4688f792

  • SHA1

    470ec74c6bd8821a418a50a8c48398f3715efe28

  • SHA256

    20d91430397028cb83296e7a41598414c9a4ef272afba435196d231a8cbd0b67

  • SHA512

    27eacaa2d7d021c45eb5dc52b41b828447bca15761834b33997eac9bba79034670da3b429d2b903712f1e9ec9132c3e41f3214ea1463d0f3ac35e630a9b5933f

  • SSDEEP

    3145728:9aj7JEyFUT2roh0SgtY0aToZns6IWkp/:oj7jOTwoWSdToZns5z

Score
7/10

Malware Config

Targets

    • Target

      Badlion Client Setup 4.0.1.exe

    • Size

      106.0MB

    • MD5

      903bd9351b62bc7cbe2557da4688f792

    • SHA1

      470ec74c6bd8821a418a50a8c48398f3715efe28

    • SHA256

      20d91430397028cb83296e7a41598414c9a4ef272afba435196d231a8cbd0b67

    • SHA512

      27eacaa2d7d021c45eb5dc52b41b828447bca15761834b33997eac9bba79034670da3b429d2b903712f1e9ec9132c3e41f3214ea1463d0f3ac35e630a9b5933f

    • SSDEEP

      3145728:9aj7JEyFUT2roh0SgtY0aToZns6IWkp/:oj7jOTwoWSdToZns5z

    Score
    4/10
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      15KB

    • MD5

      ba2cc9634ebed71cea697a31144af802

    • SHA1

      8221c522b24f4808f66a476381db3e6455eab5c3

    • SHA256

      9a3c2fe5490c34f73f1a05899ef60cfef05e0c9599cd704e524ef7a46ead67ba

    • SHA512

      dcc74bcedd9402f7ac7e2d1872fe0e2876ae93cf8bbd869d5b9b7b56cea244ba8d2891fa2b51382092b86480337936f5ec495d9005d47fbfd9e2b71cb7f6ba8f

    • SSDEEP

      384:Zhyd8Y6pu8ZaLf6Uksnw1g8BUcyHisUVb:Zhyd8Y67WGg8B/EiF

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/UAC.dll

    • Size

      14KB

    • MD5

      adb29e6b186daa765dc750128649b63d

    • SHA1

      160cbdc4cb0ac2c142d361df138c537aa7e708c9

    • SHA256

      2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    • SHA512

      b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    • SSDEEP

      192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs

    Score
    3/10
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/app-64.7z

    • Size

      105.3MB

    • MD5

      5975bcc3c69cb05665e87538473541fa

    • SHA1

      2ed07f2ae33193cab4918ed3a4821d2b54240703

    • SHA256

      bbd21d220130d3f007bb3ea34119e0e945b07194329ad13c023cd429926b9e11

    • SHA512

      0ed4b708e31772c0e4cb14938c27f6f731e5aec104526c149d417263717502ed9e637ff068008b456d774749963ac0d504de18818c5b04cf91d521e0a22e3578

    • SSDEEP

      1572864:2tsHKcC27ECeSbE4dcWMpjyZTrbkRttvkroh0SgtIUy31BpJoRoTuZg3cngHCbIn:nj7JEyFUT2roh0SgtY0aToZns6IWkp/L

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral13behavioral14

    • Target

      LICENSE.electron.txt

    • Size

      1KB

    • MD5

      4d42118d35941e0f664dddbd83f633c5

    • SHA1

      2b21ec5f20fe961d15f2b58efb1368e66d202e5c

    • SHA256

      5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

    • SHA512

      3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

    Score
    1/10
    behavioral15behavioral16

    • Target

      chrome_100_percent.pak

    • Size

      138KB

    • MD5

      0fd0a948532d8c353c7227ae69ed7800

    • SHA1

      c6679bfb70a212b6bc570cbdf3685946f8f9464c

    • SHA256

      69a3916ed3a28cd5467b32474a3da1c639d059abbe78525a3466aa8b24c722bf

    • SHA512

      0ee0d16ed2afd7ebd405dbe372c58fd3a38bb2074abc384f2c534545e62dfe26986b16df1266c5807a373e296fe810554c480b5175218192ffacd6942e3e2b27

    • SSDEEP

      3072:48Kzw9bpM/OO3eS2Z8Gb0+VRLf0ld0GY3cQ3F2DExm/KLQ2I:9Kzw96/xm8Gb0OV8ld0GecQ3mExhLY

    Score
    3/10
    behavioral17behavioral18

    • Target

      cursors/col_resize.cur

    • Size

      326B

    • MD5

      23633a8dfa3548705f28c83ee9584d6d

    • SHA1

      be5dd224d071d965bc0411206cadf9b33ddb384f

    • SHA256

      d3b49998f6d1039bf8b65f73f5784653164804c72908a40a5cf8ea850978a0d0

    • SHA512

      5b0971bf5c7bc17ae746c88e4fe3f0342d9288f8feb3ebc106b6a031d62b48af8843af0079a18c7ffe4a2200e9d6d58f92f1d87987a068bbf8e4bf7210153782

    Score
    3/10
    behavioral19behavioral20

    • Target

      cursors/col_resize.png

    • Size

      321B

    • MD5

      0723c45d9f82b0e31a1fee26b9b4f53e

    • SHA1

      5608c3c92d70c61f597d1f1d3aaa85e72ebc4dcb

    • SHA256

      6ef1e382e5e2472e8426a0f486ab51fa2216cdf929a3b737f78564a8ad57b1ab

    • SHA512

      326f31b3e25c11fee7c28040252b5eaf183b0380ef87033134ff032eca4d90a28eda08837af833e0d5c9ec06d7e63053f23c64d9fec5fda0038c27546bfc1932

    Score
    3/10
    behavioral21behavioral22

    • Target

      cursors/copy_drop.cur

    • Size

      4KB

    • MD5

      f92d1851a489b0af7ab807a2f07ebe16

    • SHA1

      d97c9d7ab76993448f6240322140dd23c756b6c6

    • SHA256

      18920d4ab5cd0b654b1e8bbc33fe5278907514a1b227f701a16b9a3309ee87ab

    • SHA512

      b4494c8da0734ec69caec38324c6b3b91e898ad8b25c9d7dee9ca56c41cdec768c16efc10d71c856a0bc633ff22cc76cb01ee8ef887899e2486fb7f78b340a7f

    • SSDEEP

      48:aWmmgXgQ4fgQgABBI/Iv/G/vvZv/m3uf2H+vz/:aN

    Score
    3/10
    behavioral23behavioral24

    • Target

      cursors/hand_grab.png

    • Size

      534B

    • MD5

      7be75a54023adbe7d6b48260e4e8d032

    • SHA1

      81f20b4e0ca495e393748e0054d9ba12b6179196

    • SHA256

      8d8b7205410e7d0e32bd6b81769d7853025f5a1b2235e93088fd327c039e6b1e

    • SHA512

      2724620cb131b175b22e405bad2c7b6f2b771cae8f8402d85933a93aad409a6d5d2c01a534ef4f10900130eec6e394b470c2451ebbae76a950f15c46229f80d0

    Score
    3/10
    behavioral25behavioral26

    • Target

      cursors/hand_grabbing.png

    • Size

      474B

    • MD5

      ddbc22bda750215abfc73d75e1105b17

    • SHA1

      f8dc1196227d95b7630dc85a3543c6db853f65cf

    • SHA256

      0e6c5b2ec6b01b9a0c52dd26dafd1c969cf073c6d47e9db8e53fa05912f73cee

    • SHA512

      5d1a6e89a1a96988230cf30fb156c166e26fc832affc5e7eb39ef974e69008403d54463a4b4a40c55c0ad8eb90e438c31a880f613d1ff42fc966ec961d396240

    Score
    3/10
    behavioral27behavioral28

    • Target

      cursors/link_drop.cur

    • Size

      4KB

    • MD5

      66e13793e687bdb92c09e0ae7964e194

    • SHA1

      71019343b1747c19503e935aff3c7aba1fb70541

    • SHA256

      49d5f9b95e9968ba54ef9457f89386fbb29d7492fb9db1af920fd3433aae4a67

    • SHA512

      19dedb36b972ab005f01deb6f1eae1b9c0609f3312fd3f70dff93285390fac7b535e5d181f4a7cb25bd4f5933538ad7ebf44154f9d6d3eb04e412144926c4143

    • SSDEEP

      12:m0EbSrSZ7SYMSvxIRcSuFSQ1SuFS829krc:mbbSrSZ7SYMSvxIRcSuFSQ1SuFS829/

    Score
    3/10
    behavioral29behavioral30

    • Target

      cursors/row_resize.cur

    • Size

      326B

    • MD5

      70618f41c70238453a7d876bac5ab501

    • SHA1

      bbf033428d8cf562ac3347440848b1b3ed1b65a2

    • SHA256

      241ca59e728f9faaa3ac9c626f44f8387a04699ec1bc468ecdae04c53ae2df04

    • SHA512

      513dfa3e15b887f4e785da9dbe04cff591a4ae3bc6d5f4b14d7dbfd3695221f6448b0d67132dbf80b1e36d9fbc2d245df23c1135d4dfa33edca3706d23bc89a4

    Score
    3/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks