Overview

overview

10

Static

static

10

0cd817392d...18.exe

windows7-x64

10

0cd817392d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0cd817392df0112a1f24c59bd8c9c22a_JaffaCakes118

  • Size

    355KB

  • MD5

    0cd817392df0112a1f24c59bd8c9c22a

  • SHA1

    e9b6860cb3780557824b9a939fa4a5272075649d

  • SHA256

    302e0dce67996f580c4700ffb331db4a31a472441627bcbff4936a279cd18256

  • SHA512

    c778bbcc9965b99db5c374bc5d679758bf1f182d7280ed025243414c4225fe423901ba5bdd859c2b33e3444b9a5291a9d905770ef0b51c26bdc6d52723655747

  • SSDEEP

    6144:VL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19I:VLdcfxaeM6fy/KaVUtgKkTZ73coNRJ

Score
10/10
upxbabylonrat

Malware Config

Extracted

Family

babylonrat

C2

156.67.251.153

Signatures

  • Babylonrat family
    babylonrat
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 0cd817392df0112a1f24c59bd8c9c22a_JaffaCakes118
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections