General

  • Target

    0chRme.exe

  • Size

    804KB

  • Sample

    240904-tn6eesvcqf

  • MD5

    418ccb1e17cffe26f54d479fba90c69e

  • SHA1

    ed698e2f701579f79b73247663a50ecc508c1c29

  • SHA256

    3f3cf4acef8a65b963a09424dca300d4f5b0e3959abd7a459fcd21d5e02becb8

  • SHA512

    7abc69cedfc9cff630cd9434e5b995118e98d5cfb6be4a48cf3b25dbfbdc59e8d7684ec3831841eb0b6509bc0e9e08933ded9e3fde49e8fa1c5653c035a3c354

  • SSDEEP

    12288:6LdcfxaeM6fy/KaVUtgKkTZ73coNRJ1F:6kIZGSAtgN+eJ1F

Malware Config

Extracted

Family

babylonrat

C2

149.28.19.207

fund.sekretariatparti.org

Targets

    • Target

      0chRme.exe

    • Size

      804KB

    • MD5

      418ccb1e17cffe26f54d479fba90c69e

    • SHA1

      ed698e2f701579f79b73247663a50ecc508c1c29

    • SHA256

      3f3cf4acef8a65b963a09424dca300d4f5b0e3959abd7a459fcd21d5e02becb8

    • SHA512

      7abc69cedfc9cff630cd9434e5b995118e98d5cfb6be4a48cf3b25dbfbdc59e8d7684ec3831841eb0b6509bc0e9e08933ded9e3fde49e8fa1c5653c035a3c354

    • SSDEEP

      12288:6LdcfxaeM6fy/KaVUtgKkTZ73coNRJ1F:6kIZGSAtgN+eJ1F

    • Babylon RAT

      Babylon RAT is remote access trojan written in C++.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks