Extracted

• • Target

    Clown.exe

  • Size

    355KB

  • MD5

    666b04054db7cd449d31ac30d0d448fa

  • SHA1

    c83a12f38392560cf97228f510bf1992626c4650

  • SHA256

    ebe6967d80552c9543d8f2e8b8cacbae667d0e504e2b8874028e2a438b63227b

  • SHA512

    1bf1ae69b8251604c329ec001cea069509d709870b9ba7f6748557d4cafd5353ad4705f56fe2b7d1a5f856a608270e2e81d06772b7e8869dc661a2754232d984

  • SSDEEP

    6144:3L1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19E:3LdcfxaeM6fy/KaVUtgKkTZ73coNRJ

  Score

  10^/10

  babylonratpersistencetrojanupx

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1

• • Target

    out.upx

  • Size

    733KB

  • MD5

    f4fee76fe5192dc611cb9589beb82c26

  • SHA1

    d200de17b4ea48cbb2d409abece50acb42bc8bc0

  • SHA256

    003de10843573b828c649e000b3f4f2667a5ed0aba2a3cc80f9f4cb903d9d82b

  • SHA512

    b6deec8dc033e79187f3af5e0bcb4f569b1ddbb626c29e29069647b030138241b874158162f7dee098574faa0fd76bc84faf2377eeabe031dc7e70940ccb05c2

  • SSDEEP

    12288:EqzcpVgUXzL0TTUKZHTNloEkOpnKgofuIwV6eAj0GZxxXMcEeg3paPcg:EqzcpKIL0TvZzNlNky0wVW0GZxcVg

  Score

  1^/10
  behavioral2