Extracted

• • Target

    ab55d958bbe9c65cd360a724fb0b19b642cb089387defdd8e748e15a4f377f45

  • Size

    2.3MB

  • MD5

    268ee5fb777b47236bfdef31c8e33241

  • SHA1

    4ff784fc21c2f314c43cd562e6beb00a381a4aca

  • SHA256

    ab55d958bbe9c65cd360a724fb0b19b642cb089387defdd8e748e15a4f377f45

  • SHA512

    599d5eb1a30b7a19c15495b1ba353946332dd1666604e697669f52905e2e4c83c1a9b2bb6bb98a7f665fbfbff21a8879a2f9ef792c85a588737bee6554fbde3a

  • SSDEEP

    24576:x1r43sfARB7U4kieI1SqjEDKcSrJIvJiu/AxWts:Pr43o67TrXIqjbcS6vJT6Wts

  Score

  10^/10

  babylonratdiscoverypersistencetrojan

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Babylonrat family

    babylonrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2