Analysis
-
max time kernel
1794s -
max time network
1608s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
29-06-2024 19:36
General
-
Target
Babylon 1.6.0.0/server.exe
-
Size
355KB
-
MD5
b3959d510f716ea5e7eac3dfecb960b2
-
SHA1
376752bd404952b7d960b0c35051c9d1f78bd1e6
-
SHA256
40bb9963dfa7bef8169b8746bcb894cd53586c3d2f4316eb6cebb242f49be1ef
-
SHA512
d7678287f5850397ce05a2711da1cd682ecb5c9c39c18d1fae01f0aa6cf786d1f110887ab2bf27cd93316c416a09f87161a9a32b6f149d572ee5ccccd24aaa8d
-
SSDEEP
6144:+L1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19:+LdcfxaeM6fy/KaVUtgKkTZ73coNRJ
Score
10/10
Malware Config
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Babylon 1.6.0.0\server.exe"C:\Users\Admin\AppData\Local\Temp\Babylon 1.6.0.0\server.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB