General

  • Target

    PDFview.exe

  • Size

    301.0MB

  • Sample

    240828-n2dcxaxblf

  • MD5

    bc598aa0d798948e0d1a9184e0e4be5e

  • SHA1

    8c20b018a33092be4b73c569380ae463d956aec1

  • SHA256

    77e22b511cd236cae46f55e50858aea174021a1cd431beaa5e7839a9d062e4c7

  • SHA512

    822f98b256dd75cbfe4ab720cacff4b60cfa18922ac259e8cb99cf57cb8b7ec6e69df9c6ba8179d19001c16aaea9f546ec17ac43b6c19f4de924a98d68eb0ab2

  • SSDEEP

    6291456:iIVKn0F7r0SL1Q2VlTstG5AP6dRM9o/bILtQXIEqpIc32:iIInAfd5z4sZdRBMOXtq2cm

Malware Config

Extracted

Family

babylonrat

C2

64.176.65.152

Targets

    • Target

      PDFview.exe

    • Size

      301.0MB

    • MD5

      bc598aa0d798948e0d1a9184e0e4be5e

    • SHA1

      8c20b018a33092be4b73c569380ae463d956aec1

    • SHA256

      77e22b511cd236cae46f55e50858aea174021a1cd431beaa5e7839a9d062e4c7

    • SHA512

      822f98b256dd75cbfe4ab720cacff4b60cfa18922ac259e8cb99cf57cb8b7ec6e69df9c6ba8179d19001c16aaea9f546ec17ac43b6c19f4de924a98d68eb0ab2

    • SSDEEP

      6291456:iIVKn0F7r0SL1Q2VlTstG5AP6dRM9o/bILtQXIEqpIc32:iIInAfd5z4sZdRBMOXtq2cm

    • Babylon RAT

      Babylon RAT is remote access trojan written in C++.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks