Overview

overview

8

Static

static

3

GOLAYA-BABE.exe

windows7-x64

8

GOLAYA-BABE.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    cb3b17cb198ac2493088d6d8fa5e5540

  • Size

    132KB

  • Sample

    240315-m25lqagh22

  • MD5

    cb3b17cb198ac2493088d6d8fa5e5540

  • SHA1

    9f387cef8907f7524cbfaaa9df51a0e96ad7587b

  • SHA256

    dcd6d891911df89e7715f14155d89595b65749c3a81cd552a34832848c01709c

  • SHA512

    4572095ded5d0a57957de284d8d59734016b92fb2aa6a63c69e1a6066492e9e40a27112158e0c07768b2457c17f0799a304f0537e25143bc7e8e00b1ab4d9766

  • SSDEEP

    3072:0rz/BRgKl+bsTJbUeosb3WPIoSdJ64JbA:0P/BRgKwgNUtSWPIoSdw41A

Score
8/10
discovery

Malware Config

Targets

    • Target

      GOLAYA-BABE.exe

    • Size

      238KB

    • MD5

      bd3875791f0a36ed9122352e1b4fe189

    • SHA1

      a3dff7bd641755b5c8b64c4aab59738ec3842d60

    • SHA256

      1973e4168c5aa035cdc9797ffdede9fac7e84064be5019f533a4ac3de2edef0f

    • SHA512

      1709eff81fc9ee3760f3d6128a228655cadd04144d1f877e2c0a04e6ce2215eeb6c2acebca02d741f3a6090a239f1f652547e4c3badcc99db64dc35a8379ff67

    • SSDEEP

      3072:tBAp5XhKpN4eOyVTGfhEClj8jTk+0hd255d5q5hQ2+Cgw5CKHm:obXE9OiTGfhEClq9uk5d5q5hQXJJUm

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks