babadeda

Resubmissions

10-06-2024 21:32

240610-1drlvasajl 10

23-04-2021 16:42

210423-hge38eda1j 8

Sharing

Copy URL

Twitter E-mail

General

Target

SecuriteInfo.com.W32.AIDetect.malware1.14311.14948
Size

2.5MB
Sample

240610-1drlvasajl
MD5

ae8f9d9b8344d52f0872dfdc852e1dd4
SHA1

7e9f4259cc193465317ee48b8428b36e74028390
SHA256

95b5d0e36464afc8391a9d056926e5859506ead18937669554bde42f7a6d135b
SHA512

27928930215dbb9217247d846c570a756b46866b17b0832c9de7c8a800e3d0457f64c28ddfb4a66372f3837695e8f1a5645804f222ac7344284facb68bc79b21
SSDEEP

49152:qFUy7w/OQkyXuS18WPu8vE2uajZ3/qUlppUAr/n7oi/dyXUETzBJi3:qFnekR+08s2uaX9tdyZTzBJi3

Score

10^/10

Malware Config

Targets

- Target
  
  SecuriteInfo.com.W32.AIDetect.malware1.14311.14948
- Size
  
  2.5MB
- MD5
  
  ae8f9d9b8344d52f0872dfdc852e1dd4
- SHA1
  
  7e9f4259cc193465317ee48b8428b36e74028390
- SHA256
  
  95b5d0e36464afc8391a9d056926e5859506ead18937669554bde42f7a6d135b
- SHA512
  
  27928930215dbb9217247d846c570a756b46866b17b0832c9de7c8a800e3d0457f64c28ddfb4a66372f3837695e8f1a5645804f222ac7344284facb68bc79b21
- SSDEEP
  
  49152:qFUy7w/OQkyXuS18WPu8vE2uajZ3/qUlppUAr/n7oi/dyXUETzBJi3:qFnekR+08s2uaX9tdyZTzBJi3
Score

10^/10

babadeda diamondfox botnet crypter infostealer loader stealer
- Babadeda
  Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
  loader crypter babadeda
- Babadeda Crypter
- DiamondFox
  DiamondFox is a multipurpose botnet with many capabilities.
  botnet stealer diamondfox
- DiamondFox payload
  Detects DiamondFox payload in file/memory.
  infostealer
- Executes dropped EXE
- Loads dropped DLL
behavioral1
- Target
  
  CachemanControlPanel.exe
- Size
  
  3.2MB
- MD5
  
  5d3bf7a18887582b8a2cea327f2e7ba6
- SHA1
  
  83843851b7b7beb2b1853b813e7f0b1666b1bd62
- SHA256
  
  014d644eccc232cd6906c5abf8afd3e53f94004057d4a1bb2771dfea00f0ae4b
- SHA512
  
  3d4ffc844b211fae199f3da8b557cec2f6e882b8be42f3d99882eaa3e9d73018f8c06971cb783d223f3423d0c55788b7520bd57fd33d8d2dfe6c4be9455e62d7
- SSDEEP
  
  49152:RU18F61w5Ts0AzHc8ZqfV7xPmljnjWwIZnQjH0xe0bQBTAMUlZyu:ifSXmHc8ctVPmZnj7IywZF
Score

10^/10

diamondfox botnet infostealer stealer
- DiamondFox
  DiamondFox is a multipurpose botnet with many capabilities.
  botnet stealer diamondfox
- DiamondFox payload
  Detects DiamondFox payload in file/memory.
  infostealer
behavioral2
- Target
  
  Qt5Concurrentd.dll
- Size
  
  74KB
- MD5
  
  2378a50282d97268da9ef31e5850f44a
- SHA1
  
  96f5657d700769370e7da406321deb80e3a782a5
- SHA256
  
  eba986e025deb2b5e7e16d69a7f6e8266c5d3576074b36fdf4fd8ccc90824c7c
- SHA512
  
  65d63594f7406055e5cf24f53ae6987b9d4cf95189cb0705a33bbe8c358d7aa1fe169b121f723063add2548464cbaa8fb5e6b790b75407d6ecc2cb73621af790
- SSDEEP
  
  1536:qDmWfeg9w00eRovEaEI5Zs8kJqsJpni/xCGWL/ftUfT:iu00eR6EaEI5Zs8kJqsJpni/xCGWLnA
Score

1^/10
behavioral3
- Target
  
  libblkmaker-0.1-6.dll
- Size
  
  74KB
- MD5
  
  c724b7986c72ea00cea20e4eea4e0c84
- SHA1
  
  e5d823be1b32561617f34078f45cb2afd5331feb
- SHA256
  
  7cf28a256b6a462546db89e2c8c8a70d0d759fe62567af20bddf57e63d4963b7
- SHA512
  
  08b549a9de0d4b28807070ce8ba2ecd5f74225bf0f434e91e3e544da60a603d079a504735d5f4e10f2ad29f97bbfbf6a7b91e3265b249fd56baf92e33b2769fe
- SSDEEP
  
  768:OCXGtEGupmGP9FAnIbGVgNy5dbOdr63EKcoD1vQIxxfIXdt:OFgcMAWGVgNy5dbOBJCQIxxgXdt
Score

1^/10
behavioral4
- Target
  
  libgcc_s_seh-1.dll
- Size
  
  74KB
- MD5
  
  534b365361004828059600f05b34006d
- SHA1
  
  d8ff411b0939a021f47c845c6a90f1240bab5268
- SHA256
  
  438ae82ffd621a2413199155574cc85681f8986f05420b1485aa4be936c3bc0b
- SHA512
  
  1ccb3732a82f2fedca85c27afdd48e65dde70d5b1620e436d457624a2cb796887c5e7dc2983a0794ebbbcade3e5b9f9fc9320b390894471993c7b1e85268592d
- SSDEEP
  
  1536:TVhSLCst8rZQk8HzR8+lXbPtccSPOrBT3SIKBx:itu7+lOcCO1TI/
Score

1^/10
behavioral5
- Target
  
  libgraph31.dll
- Size
  
  71KB
- MD5
  
  040352d2528df9a7ec3b5adca3bab444
- SHA1
  
  a08dbfa5d9edc2eba36fd0fe287e0fb1e37a7e97
- SHA256
  
  a276f57503bad9a4bca17e8e057993607e715c1fa6c7d2e136a2290a19efd560
- SHA512
  
  b7c62efced3819419c539420b127c183d28fd39834ddd9abcdc60641b3f2bc731e15543d3e53cf5f1db06743cbe9cc74b2c03a6ebd5a7088795951e47a107cc6
- SSDEEP
  
  1536:klv6q1ZwQpNmwLsBHvahLdYZPLdsWVcdyXWADttnY:eZZDNTsBHvS+VYyXWAJtnY
Score

7^/10
- Drops startup file
behavioral6
- Target
  
  libgstcontroller-1.0-0.dll
- Size
  
  74KB
- MD5
  
  8cf8b4b065bf720ae2d96dba7b86f285
- SHA1
  
  8d0cd6b3860ee0dc23ac261814f7c2db282f127e
- SHA256
  
  6c6aec02a64caa9f868f2fddc14f666ca4fffd27d41010affd1a5826852b3d09
- SHA512
  
  81dbecefb5a1fcfb470d56b8358455c79970507ebfce966590ceee94884466c9d9034f8ce4ae9e2b6633cb796a154f5ed93c66324e3963dec30106a6f8dc9e1c
- SSDEEP
  
  1536:c8p2RxGoPW5Oa6uUDsCGln6K1Ax6K//u3D5NSSG3H0SATWzC9Y0JwazM1s7f:c8p2R1HnDsbn8xt/G8SG3H0SA4C9Y0JP
Score

1^/10
behavioral7
- Target
  
  libogg-0.dll
- Size
  
  82KB
- MD5
  
  87a4e5bc51a9c2533ac5308f3343a76b
- SHA1
  
  3427c4cd2f63ddb6787fbc3ee736b3b2433f0b91
- SHA256
  
  cccdc7c91a6ad01d2e1af8555fbde94787bf5ee39a61703008d0c2ed7f9e6ebe
- SHA512
  
  0659a6407ab1b9451c79f684be24c78fa8ffc3de6b5dfdde3ae90141567897001194f9849b50ef0a9643abbcfa4f73c09254e771b0103a406df04cc4d188359a
- SSDEEP
  
  768:RIBmX6tFu4kYOvBHwDFHs0YZqCC3m1/z0BDtZH5zhG4tZtVnDPo1SndQzJdn1W:KBmX6S4kYOvJGMRZABDflIQiMnAJd1W
Score

1^/10
behavioral8
- Target
  
  libxml3.dll
- Size
  
  532KB
- MD5
  
  5ae30e4cdabb5b269b7eb358aae2d5e2
- SHA1
  
  58aae25bf64bd0b15be33ceb47ddb6ef3802433a
- SHA256
  
  0b2cabaf0b2aef51c3396b11e604c46b65eabc0cbde3e257bc9c9fd1c2446c6f
- SHA512
  
  2d4a2aad072bebbc707af9dca22c54f6d9607e6f7bc8826bcb61b0321f4e0464884f4577dc51dcfb7a40a9b143cf9e26225694ef4668f629f632870d11afa198
- SSDEEP
  
  12288:EJSjsd4Hd2kR6vk9YE0quvI1bi1TpD1BQwz9554Ya8Th7h:h956vk9YE0qwUwz934Ya8ThN
Score

3^/10
behavioral9
- Target
  
  vcruntime140.dll
- Size
  
  74KB
- MD5
  
  5f9d90d666620944943b0d6d1cca1945
- SHA1
  
  08ead2b72a4701349430d18d4a06d9343f777fa6
- SHA256
  
  9ec4afad505e0a3dad760fa5b59c66606ae54dd043c16914cf56d7006e46d375
- SHA512
  
  be7a2c9dae85e425a280af552dbd7efd84373f780fa8472bab9a5ff29376c3a82d9dfa1fef32c6cf7f45ba6e389de90e090cb579eebff12dcfe12e6f3e7764d1
- SSDEEP
  
  1536:TpIhq3RcCBwca4EZEXNciFk+ikPC+ecbiLgavG:TpIY3RcCKcajodF4+ecbiLI
Score

3^/10
behavioral10
- Target
  
  zlib.dll
- Size
  
  83KB
- MD5
  
  f433b1aab2d8f62edfa2fd2e3686e5f0
- SHA1
  
  c06891308b99388554c745fb80e359330d8fbced
- SHA256
  
  193b8f5ad2b61b5850753ea83df27ef776c5e43e041a6a984fb551ca8140a33a
- SHA512
  
  59c85c328c25f03fba12e22a9b31ae5461941050d808f65565a361b6bd8413beb45852dab31088db23beb5da205d0619ef3cf3a62ed4ab7848de1a3fd7bc20a3
- SSDEEP
  
  1536:hoEz8+iLbyuv7MBe0HQOsgGu5myOT94vnToIff5IOcIOY3kNFoU4Pao:Jz8zLbyG7MBeD1YOT6TBfrSYUFotx
Score

1^/10
behavioral11

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Babadeda Crypter

DiamondFox

DiamondFox payload

Executes dropped EXE

Loads dropped DLL

DiamondFox

DiamondFox payload

Drops startup file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11