babbleloader | 6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6[.]exe

General

Target
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe
Size 1.6MB
Sample250129-davsrsymav
SHA256 6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6
MD5 7d1a15fd3c17ad226b3516bea26d7a94
SHA1 1fea1c73332b3708b1eb1f2caf80faff3db47c0a
SHA512 37602ed7869971f113c9dcf5ecbdd07c5982ea5cfc3bb17bac61f3404f0f00df4fa55a128bc081109a0151ceb53698f19b2c58d6126b30d6f96eebc39c405a78
SSDEEP 24576:fMN6PENnBBQXf1UCyfGH32hEFS3qWcI6baD8U2ZuDqk4EB:fM15BBwKjEF3M2A1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

babbleloader

Malware Config

Signatures

Babbleloader family
babbleloader

Detects BabbleLoader Payload 1 IoCs

resource	yara_rule
sample	family_babbleloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe

File Explorer

6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe

.exe 1.6MB

6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe

IMPHASH fe99e7ecdc5c896e52392c8a198886e3
SHA256 6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6
MD5 7d1a15fd3c17ad226b3516bea26d7a94
SHA1 1fea1c73332b3708b1eb1f2caf80faff3db47c0a
SHA512 37602ed7869971f113c9dcf5ecbdd07c5982ea5cfc3bb17bac61f3404f0f00df4fa55a128bc081109a0151ceb53698f19b2c58d6126b30d6f96eebc39c405a78
SSDEEP 24576:fMN6PENnBBQXf1UCyfGH32hEFS3qWcI6baD8U2ZuDqk4EB:fM15BBwKjEF3M2A1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects BabbleLoader Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1558040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetStdHandle GetCommandLineA GetEnvironmentVariableA SetEnvironmentVariableA SetCurrentDirectoryA FindClose FindCloseChangeNotification FindFirstChangeNotificationA FindFirstFileA FindNextChangeNotification FindNextFileA FindVolumeClose GetDiskFreeSpaceExA GetFileAttributesA GetFileAttributesExA GetFileSize GetFileSizeEx GetFullPathNameA ReadFileEx SetEndOfFile SetFileAttributesA UnlockFileEx GetCompressedFileSizeA AreFileApisANSI GetTempPathA GetVolumeInformationA SetFileApisToOEM HeapCreate GetQueuedCompletionStatus SleepEx GetCurrentProcessId ExitProcess GetExitCodeProcess GetCurrentThread SetThreadPriority SetThreadPriorityBoost GetThreadPriorityBoost GetThreadPriority ExitThread TerminateThread GetExitCodeThread ResumeThread TlsSetValue SetPriorityClass GetPriorityClass GetProcessId GetProcessHandleCount SetProcessPriorityBoost SetThreadIdealProcessor GetProcessShutdownParameters GetProcessWorkingSetSize QueueUserWorkItem SetInformationJobObject GetBinaryTypeA GetProcessIoCounters SwitchToFiber ConvertFiberToThread ConvertThreadToFiber GetTapeStatus GetStdHandle BackupSeek GetLogicalDriveStringsA GetStartupInfoA DefineDosDeviceA QueryDosDeviceA CopyFileA CopyFileExA MoveFileA MoveFileWithProgressA FindFirstVolumeA FindNextVolumeA GetVolumeNameForVolumeMountPointA GetDateFormatA GetTimeFormatA GetStringTypeW IsValidCodePage CompareStringA GetLocaleInfoA GetNumberFormatA EnumSystemGeoID GetUserGeoID ConvertDefaultLocale SetThreadLocale GetUserDefaultLangID GetSystemDefaultLangID GetSystemDefaultLCID GetStringTypeExA GetStringTypeA GetConsoleCP GetNumberOfConsoleInputEvents ReadConsoleInputA SetConsoleCtrlHandler FillConsoleOutputAttribute GenerateConsoleCtrlEvent FlushConsoleInputBuffer GetConsoleCursorInfo SetConsoleCursorInfo SetConsoleScreenBufferSize SetConsoleCursorPosition GetLargestConsoleWindowSize WriteConsoleOutputCharacterA ReadConsoleOutputCharacterA ReadConsoleOutputAttribute ScrollConsoleScreenBufferA WriteConsoleOutputA SetConsoleTitleA GetNumberOfConsoleMouseButtons GetConsoleFontSize GetConsoleWindow VerLanguageNameA WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcAddress lstrcmpA GetModuleHandleA HeapReAlloc HeapSize QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader WriteFile GetModuleFileNameW GetCurrentProcess TerminateProcess GetModuleHandleExW HeapAlloc HeapFree FindFirstFileExW FindNextFileW GetACP GetOEMCP GetCPInfo GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap

winspool.drv

WritePrinter FindClosePrinterChangeNotification FindNextPrinterChangeNotification FindFirstPrinterChangeNotification ScheduleJob ReadPrinter AbortPrinter

advapi32

DecryptFileA GetUserNameA

dxgi

CreateDXGIFactory

Sharing