Extracted

• • Target

    15b805ea0121bfaeadcd2e6f4cafce3199a91209f04b599bb333dca9010aeb55N.exe

  • Size

    735KB

  • MD5

    8b3abbb304f163345e23e9c6b1e70a90

  • SHA1

    2f55f460322b4a687bc08e0f527e24b4a53e029c

  • SHA256

    15b805ea0121bfaeadcd2e6f4cafce3199a91209f04b599bb333dca9010aeb55

  • SHA512

    7894285b95a882b2bf1f66822e1a0e24d07b96dd0738238e87a12155e2613bf05baca081c4faa4e9597d99d4a6eca00fabfe7c7dc45b4ff193c4fbfad27b9f37

  • SSDEEP

    12288:trsTMcgRdrEAzvHG4z2T6DSsyXUGz2FcFe0fySvZyESEGWKy:trsaRdrEAbm4zbryUGCMfySQ3y

  Score

  10^/10

  babylonratdiscoverypersistencetrojanupx

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Babylonrat family

    babylonrat

  • Drops startup file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2