Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-09-2024 00:02
General
-
Target
f95f61a2e2dab5bd1d51cf011f260684_JaffaCakes118.exe
-
Size
355KB
-
MD5
f95f61a2e2dab5bd1d51cf011f260684
-
SHA1
9c3313c67f56397f4531b51b3b8f513e6f277f9d
-
SHA256
f4d0a178f7b9828c1bf425a90dde4199326806709a0c9ebe71d4c0c64244957a
-
SHA512
0788dcc03fe2100c27782df4b56f3d028c80e428acc18f9195b7e9cf97b6371ec4b80e9eff4c41f770349f6d223513764693560ddafc74373aa8f5e1f7b9e7ba
-
SSDEEP
6144:pL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19:pLdcfxaeM6fy/KaVUtgKkTZ73coNRJ
Score
10/10
Malware Config
Extracted
Family
babylonrat
C2
82.45.235.100
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f95f61a2e2dab5bd1d51cf011f260684_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f95f61a2e2dab5bd1d51cf011f260684_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB