Extracted

• • Target
    d4efd4c8c02bf1c7130efdcf474f1b69
  • Size 899KB
  • SHA256 c7e1a1b08de4b6e01a17e4c4d5795964dae98aadba3fdd3ff5da33fc5adae7f6
  • MD5 d4efd4c8c02bf1c7130efdcf474f1b69
  • SHA1 3f17c11369338e6767fe0dade8a0f9dbc7ddac27
  • SHA512 9e8da8bd66fb3771523c98eb58ed343f3c360e67cb3978a332c176c5e8e4717a6a0ecb391118812b8d76be92637c88d3ffc10c82769cf96a1d1d5b3abf4f8e78
  • SSDEEP 24576:dLJEU63Vi1wZDIzR2D4M0Q2VVFByf9djCf:xJJGZDn46abB4dO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionpersistencebabylonrattrojanupx

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Babylonrat family

    babylonrat

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2