General

  • Target

    controller.exe

  • Size

    300.8MB

  • Sample

    240828-nplthsyclj

  • MD5

    a17a1666f47953d6e505182909c74170

  • SHA1

    b1054b4702ff9b112dfdf8ce40f0fdf399ba8a95

  • SHA256

    f21ae37cb39658a62c9aaa945eb4dc2b33aebe4afeb5374d36328589a53e0982

  • SHA512

    406734af8e7feb8a0736740295a25734cf12e89fb0e8785d33199debe2ce49a6d33bf8f4a7d6bc73b9ae1f91d288a77af41e204c8e61be59c64d153b0e7642db

  • SSDEEP

    6291456:etfHLnhapc6UQ5cBe4raaM7N+2i35r6pLOfEL44iC:Qfdapc6FEWk5rei8L43C

Malware Config

Extracted

Family

babylonrat

C2

149.28.19.207

fund.sekretariatparti.org

Targets

    • Target

      controller.exe

    • Size

      300.8MB

    • MD5

      a17a1666f47953d6e505182909c74170

    • SHA1

      b1054b4702ff9b112dfdf8ce40f0fdf399ba8a95

    • SHA256

      f21ae37cb39658a62c9aaa945eb4dc2b33aebe4afeb5374d36328589a53e0982

    • SHA512

      406734af8e7feb8a0736740295a25734cf12e89fb0e8785d33199debe2ce49a6d33bf8f4a7d6bc73b9ae1f91d288a77af41e204c8e61be59c64d153b0e7642db

    • SSDEEP

      6291456:etfHLnhapc6UQ5cBe4raaM7N+2i35r6pLOfEL44iC:Qfdapc6FEWk5rei8L43C

    • Babylon RAT

      Babylon RAT is remote access trojan written in C++.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks