babbleloader | bloader[.]exe

General

Target
bloader.exe
Size 1.6MB
Sample250123-x3twqa1rap
SHA256 a08db4c7b7bacc2bacd1e9a0ac7fbb91306bf83c279582f5ac3570a90e8b0f87
MD5 fa3d03c319a7597712eeff1338dabf92
SHA1 f055ba8a644f68989edc21357c0b17fdf0ead77f
SHA512 80226bb11d56e4dc2dbc4fc6aade47db4ca4c539b25ee70b81465e984df0287d5efcadb6ec8bfc418228c61bd164447d62c4444030d31655aaeed342e2507ea1
SSDEEP 24576:ZMN6PENnBBQXf1UCyfGH32hEFS3qWcI6baD8U2ZuLCk4EB:ZM15BBwKjEF3M2A1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

babbleloader

Malware Config

Signatures

Babbleloader family
babbleloader

Detects BabbleLoader Payload 1 IoCs

resource	yara_rule
sample	family_babbleloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bloader.exe

File Explorer

bloader.exe

.exe 1.6MB

bloader.exe

IMPHASH fe99e7ecdc5c896e52392c8a198886e3
SHA256 a08db4c7b7bacc2bacd1e9a0ac7fbb91306bf83c279582f5ac3570a90e8b0f87
MD5 fa3d03c319a7597712eeff1338dabf92
SHA1 f055ba8a644f68989edc21357c0b17fdf0ead77f
SHA512 80226bb11d56e4dc2dbc4fc6aade47db4ca4c539b25ee70b81465e984df0287d5efcadb6ec8bfc418228c61bd164447d62c4444030d31655aaeed342e2507ea1
SSDEEP 24576:ZMN6PENnBBQXf1UCyfGH32hEFS3qWcI6baD8U2ZuLCk4EB:ZM15BBwKjEF3M2A1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects BabbleLoader Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1558040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetStdHandle GetCommandLineA GetEnvironmentVariableA SetEnvironmentVariableA SetCurrentDirectoryA FindClose FindCloseChangeNotification FindFirstChangeNotificationA FindFirstFileA FindNextChangeNotification FindNextFileA FindVolumeClose GetDiskFreeSpaceExA GetFileAttributesA GetFileAttributesExA GetFileSize GetFileSizeEx GetFullPathNameA ReadFileEx SetEndOfFile SetFileAttributesA UnlockFileEx GetCompressedFileSizeA AreFileApisANSI GetTempPathA GetVolumeInformationA SetFileApisToOEM HeapCreate GetQueuedCompletionStatus SleepEx GetCurrentProcessId ExitProcess GetExitCodeProcess GetCurrentThread SetThreadPriority SetThreadPriorityBoost GetThreadPriorityBoost GetThreadPriority ExitThread TerminateThread GetExitCodeThread ResumeThread TlsSetValue SetPriorityClass GetPriorityClass GetProcessId GetProcessHandleCount SetProcessPriorityBoost SetThreadIdealProcessor GetProcessShutdownParameters GetProcessWorkingSetSize QueueUserWorkItem SetInformationJobObject GetBinaryTypeA GetProcessIoCounters SwitchToFiber ConvertFiberToThread ConvertThreadToFiber GetTapeStatus GetStdHandle BackupSeek GetLogicalDriveStringsA GetStartupInfoA DefineDosDeviceA QueryDosDeviceA CopyFileA CopyFileExA MoveFileA MoveFileWithProgressA FindFirstVolumeA FindNextVolumeA GetVolumeNameForVolumeMountPointA GetDateFormatA GetTimeFormatA GetStringTypeW IsValidCodePage CompareStringA GetLocaleInfoA GetNumberFormatA EnumSystemGeoID GetUserGeoID ConvertDefaultLocale SetThreadLocale GetUserDefaultLangID GetSystemDefaultLangID GetSystemDefaultLCID GetStringTypeExA GetStringTypeA GetConsoleCP GetNumberOfConsoleInputEvents ReadConsoleInputA SetConsoleCtrlHandler FillConsoleOutputAttribute GenerateConsoleCtrlEvent FlushConsoleInputBuffer GetConsoleCursorInfo SetConsoleCursorInfo SetConsoleScreenBufferSize SetConsoleCursorPosition GetLargestConsoleWindowSize WriteConsoleOutputCharacterA ReadConsoleOutputCharacterA ReadConsoleOutputAttribute ScrollConsoleScreenBufferA WriteConsoleOutputA SetConsoleTitleA GetNumberOfConsoleMouseButtons GetConsoleFontSize GetConsoleWindow VerLanguageNameA WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcAddress lstrcmpA GetModuleHandleA HeapReAlloc HeapSize QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader WriteFile GetModuleFileNameW GetCurrentProcess TerminateProcess GetModuleHandleExW HeapAlloc HeapFree FindFirstFileExW FindNextFileW GetACP GetOEMCP GetCPInfo GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap

winspool.drv

WritePrinter FindClosePrinterChangeNotification FindNextPrinterChangeNotification FindFirstPrinterChangeNotification ScheduleJob ReadPrinter AbortPrinter

advapi32

DecryptFileA GetUserNameA

dxgi

CreateDXGIFactory

Sharing