Extracted

• • Target

    dcd2a5fdcbba96f26247f193d5e68b5673fe48236b1b7d6a6af1842e5b80c14e.exe

  • Size

    735KB

  • MD5

    228964fd171143c0fc1a2c7067857159

  • SHA1

    eda5e7b3ce61ad23c579c953e8b3fa79aa167321

  • SHA256

    dcd2a5fdcbba96f26247f193d5e68b5673fe48236b1b7d6a6af1842e5b80c14e

  • SHA512

    3ca61bc0eac3cd487e681c48db0523ffd9d0bf7de4e65e284f66810e91914b2d0e33a511e6eaee240ae8b2a4160a18311d685f587845bd1a6ae98f6e01520847

  • SSDEEP

    12288:trsTMcgRdrEAzvHG4z2T6DSsyXUGz2FcFe0fySvZyESEGWKm:trsaRdrEAbm4zbryUGCMfySQ3m

  Score

  10^/10

  babylonratdiscoverypersistencetrojanupx

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Babylonrat family

    babylonrat

  • Drops startup file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2