Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
17-04-2024 15:50
General
-
Target
Shampion External V2.exe
-
Size
355KB
-
MD5
1183f72c91a0522b09172dd91c3bc670
-
SHA1
38b1ea5cd1111092d5b37c518024e9676d3984ac
-
SHA256
b8cc7d58c881ec6cc33c5c88a482a6406c98ad264d1903958e83d709cbae189a
-
SHA512
ed09a78a8334e9db1da712bc0a24369d2ed23bd6e2b49b9f711bcf9cabe35c8d8bd7cfca7f88d4b2f3f0a511dc479528f8dc33490aafbc929bbdd5209cd0243a
-
SSDEEP
6144:EL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19:ELdcfxaeM6fy/KaVUtgKkTZ73coNRJ
Score
10/10
Malware Config
Extracted
Family
babylonrat
C2
178.237.235.15
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shampion External V2.exe"C:\Users\Admin\AppData\Local\Temp\Shampion External V2.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB