babylonrat | 2fb9f562f520fd3634d13a8d9aa7fa1ec683122e72c52f7e6cc1f300d8214593N[.]exe | Triage

Sharing

General

Target

2fb9f562f520fd3634d13a8d9aa7fa1ec683122e72c52f7e6cc1f300d8214593N.exe
Size

885KB
MD5

1ba442678a63ac8b3612a0ab544d2280
SHA1

a17a8b7a78b5c710461184f524ef427a1e5c270b
SHA256

2fb9f562f520fd3634d13a8d9aa7fa1ec683122e72c52f7e6cc1f300d8214593
SHA512

f49959cc67814a20322c2636c66276f896f85e12caec8961d911ddb9d4fb6c522bdb043c7447f2c5b1b06f0d53d002ac2b9419687dff3d8b94ea1c14af59cb88
SSDEEP

24576:wqzcpKIL0TvZzNlNky0wVW0SZxpVg+fLTf/h:p6j0TvZzNlNk3w00SZxpVg+fLTf/h

Score

10^/10

babylonrat

Malware Config

Signatures

Babylonrat family
babylonrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2fb9f562f520fd3634d13a8d9aa7fa1ec683122e72c52f7e6cc1f300d8214593N.exe

Files

2fb9f562f520fd3634d13a8d9aa7fa1ec683122e72c52f7e6cc1f300d8214593N.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 109KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ