Overview

overview

8

Static

static

3

GOLAYA-BABE.exe

windows7-x64

8

GOLAYA-BABE.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    9bc0d5f68a3873036becf6067380c27c

  • Size

    78KB

  • Sample

    240214-qcsseabd41

  • MD5

    9bc0d5f68a3873036becf6067380c27c

  • SHA1

    a96c4e6e175de50dd89ad0d019c0bf127ed0d0c4

  • SHA256

    b91ff35eed56f8e8a9109484cef95e94c146a84324ca9deda1154947022ce7d3

  • SHA512

    d3eaf4bc27c40b01e8d0c3627a3196195610eed88303e242a4234ea3e1d13d7856cb0ae41a08f452b7cdeac00ed8c2f79f6dae7040b4f337e5e01fadd3593408

  • SSDEEP

    1536:wQwfwimgTY23tG90wIsWfHlWKSd+QSqWU5FJ2hZ+cYS4BHKFJtBf9ntlsp0OI:wnoimg13tG90HdQ3Sqtlm+VSFJ/lntl7

Score
8/10

Malware Config

Targets

    • Target

      GOLAYA-BABE.exe

    • Size

      180KB

    • MD5

      2e7d20079b41b69b3b16ecbd895be189

    • SHA1

      c63b1f1a9ec96ca7b0fc0d92bc082593e1df85e0

    • SHA256

      8aac418dfae104c626385ba620705f3d8f83ad9753020474a7fd41db3e808fc6

    • SHA512

      ab1326e5b177a7d32f7d97c0d3efce235df0da4d2b2faf40528fe399e0adccb6e7c67c2aac07f15294be6c23f12b966c9fc3135d9b8f561e99f10a5ad98532e9

    • SSDEEP

      3072:TBAp5XhKpN4eOyVTGfhEClj8jTk+0h6eXmUS:+bXE9OiTGfhEClq9deXY

    Score
    8/10

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks