Extracted

• • Target

    HEUR-Trojan-Spy.Win32.Larby.gen-b0ccdc361180712a49afa59b2ec75eca2c94eac89667349be9255f283aa0b0e6

  • Size

    926KB

  • MD5

    cc07a3a171e1c2bfe860e797a0bca7b2

  • SHA1

    5f2a2e9bc930b98c6f4d7cf8af133aa34f12d7f3

  • SHA256

    b0ccdc361180712a49afa59b2ec75eca2c94eac89667349be9255f283aa0b0e6

  • SHA512

    6432c7bc6c1744c9ee46e26e77c1cf5556de800d315f67f91b9f3f07cb399a45bc1a168b1510df79ad30983e7f1fb724c2eb821764f91c7748e119db80b3ee0c

  • SSDEEP

    24576:jAFjjF2hCz1K0fbK+5S6n/J2S+W36mDtZL3h87e:0FjjF2czl7MULRtZe7

  Score

  10^/10

  babylonratdiscoverytrojan

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Babylonrat family

    babylonrat

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2