Behavioral task
behavioral1
Sample
8110000.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8110000.exe
Resource
win10v2004-20240802-en
General
-
Target
8110000.exe
-
Size
809KB
-
MD5
c237d781322fc6f46ed9461cad3bfd6a
-
SHA1
d89c5b0560617bc963910cadba1c81a450ca23f3
-
SHA256
c7f542065f33302b2513999b607cc2ba8bfa5c7c12bdd7fdf5602fd330c353d0
-
SHA512
7a54ee627525bb56b27a21c6f3c2f76f36206718743816f20a31efc42cf37e64e2d22047ec466a01026c7388406e9c49656b1bad2c09fbcd77848224d86a367b
-
SSDEEP
24576:YbZVh3gziW7glJl3gvIiXC6Fezh+1Zr3Vg6k:o3Qzisgl/3gvIiX5FQ+1Zr3Vg
Malware Config
Signatures
-
Babylonrat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8110000.exe
Files
-
8110000.exe.exe windows:5 windows x86 arch:x86
651c5947133baf5aea6bd07d3540f870
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
netapi32
NetApiBufferFree
NetUserEnum
NetUserEnum
powrprof
SetSuspendState
SetSuspendState
psapi
GetModuleFileNameExW
GetModuleBaseNameW
GetModuleBaseNameW
shlwapi
SHCreateMemStream
SHGetValueA
SHCreateMemStream
ws2_32
WSAStartup
connect
ioctlsocket
inet_ntop
inet_pton
freeaddrinfo
GetAddrInfoW
WSACleanup
closesocket
htons
sendto
socket
send
recv
recv
gdiplus
GdipFree
GdiplusShutdown
GdipCloneImage
GdipCreateBitmapFromGdiDib
GdipSaveImageToStream
GdipDisposeImage
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipAlloc
GdipFree
comctl32
InitCommonControlsEx
crypt32
CryptUnprotectData
Sections
UPX0 Size: 440KB - Virtual size: 440KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 356KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE