Overview

overview

10

Static

static

7

2d025269f5...18.exe

windows7-x64

10

2d025269f5...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2d025269f56867da66563db280ab6569_JaffaCakes118
  • Size 2.7MB
  • Sample240510-df6gfsfa51
  • SHA256 6c90a79a689fe5e644eb84fa9841e651cc95ce72097d682782bf6a843cb74945
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
babylonratpersistencetrojanupx

Malware Config

Extracted

Family

  • babylonrat

C2

  • 185.82.216.57

Targets

    • Target
      2d025269f56867da66563db280ab6569_JaffaCakes118
    • Size 2.7MB
    • SHA256 6c90a79a689fe5e644eb84fa9841e651cc95ce72097d682782bf6a843cb74945
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    babylonratpersistencetrojanupx

    • Babylon RAT

      Babylon RAT is remote access trojan written in C++.

      trojanbabylonrat

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks