Behavioral task
behavioral1
Sample
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe
Resource
win10v2004-20250129-en
General
-
Target
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.zip
-
Size
740KB
-
MD5
7d48f730dae1390f78afd02dc6451b9a
-
SHA1
5cfa7bf5c7b953afe0e78b90c0fac6c5d721b1d5
-
SHA256
b76d081a35e95dd09115cc24d66dffe593fd6b2a20f84a08a3dcb0d39916024f
-
SHA512
d75d4d4ea129bbc7b62c1d15486fbd12aa5157c9ddb14c013315a7b7d702aaa924740968a504e5f22549ccdf3a1403512149ec4c4a8dfc4ce26dae4ec5dabfaf
-
SSDEEP
12288:VifeBvNZBs60eWYVwaML9xolZF7loj8aye7ZN6qaxXrRRpEHrm3be/wRMF45MR:ViGNoSPVwaMLm7ij8wZmxN8are/w95MR
Malware Config
Signatures
-
Babbleloader family
-
Detects BabbleLoader Payload 1 IoCs
resource yara_rule static1/unpack001/6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe family_babbleloader -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe
Files
-
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.zip.zip
Password: infected
-
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe.exe windows:6 windows x64 arch:x64
fe99e7ecdc5c896e52392c8a198886e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetStdHandle
GetCommandLineA
GetEnvironmentVariableA
SetEnvironmentVariableA
SetCurrentDirectoryA
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstFileA
FindNextChangeNotification
FindNextFileA
FindVolumeClose
GetDiskFreeSpaceExA
GetFileAttributesA
GetFileAttributesExA
GetFileSize
GetFileSizeEx
GetFullPathNameA
ReadFileEx
SetEndOfFile
SetFileAttributesA
UnlockFileEx
GetCompressedFileSizeA
AreFileApisANSI
GetTempPathA
GetVolumeInformationA
SetFileApisToOEM
HeapCreate
GetQueuedCompletionStatus
SleepEx
GetCurrentProcessId
ExitProcess
GetExitCodeProcess
GetCurrentThread
SetThreadPriority
SetThreadPriorityBoost
GetThreadPriorityBoost
GetThreadPriority
ExitThread
TerminateThread
GetExitCodeThread
ResumeThread
TlsSetValue
SetPriorityClass
GetPriorityClass
GetProcessId
GetProcessHandleCount
SetProcessPriorityBoost
SetThreadIdealProcessor
GetProcessShutdownParameters
GetProcessWorkingSetSize
QueueUserWorkItem
SetInformationJobObject
GetBinaryTypeA
GetProcessIoCounters
SwitchToFiber
ConvertFiberToThread
ConvertThreadToFiber
GetTapeStatus
GetStdHandle
BackupSeek
GetLogicalDriveStringsA
GetStartupInfoA
DefineDosDeviceA
QueryDosDeviceA
CopyFileA
CopyFileExA
MoveFileA
MoveFileWithProgressA
FindFirstVolumeA
FindNextVolumeA
GetVolumeNameForVolumeMountPointA
GetDateFormatA
GetTimeFormatA
GetStringTypeW
IsValidCodePage
CompareStringA
GetLocaleInfoA
GetNumberFormatA
EnumSystemGeoID
GetUserGeoID
ConvertDefaultLocale
SetThreadLocale
GetUserDefaultLangID
GetSystemDefaultLangID
GetSystemDefaultLCID
GetStringTypeExA
GetStringTypeA
GetConsoleCP
GetNumberOfConsoleInputEvents
ReadConsoleInputA
SetConsoleCtrlHandler
FillConsoleOutputAttribute
GenerateConsoleCtrlEvent
FlushConsoleInputBuffer
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleScreenBufferSize
SetConsoleCursorPosition
GetLargestConsoleWindowSize
WriteConsoleOutputCharacterA
ReadConsoleOutputCharacterA
ReadConsoleOutputAttribute
ScrollConsoleScreenBufferA
WriteConsoleOutputA
SetConsoleTitleA
GetNumberOfConsoleMouseButtons
GetConsoleFontSize
GetConsoleWindow
VerLanguageNameA
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetProcAddress
lstrcmpA
GetModuleHandleA
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
WriteFile
GetModuleFileNameW
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindFirstFileExW
FindNextFileW
GetACP
GetOEMCP
GetCPInfo
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
winspool.drv
WritePrinter
FindClosePrinterChangeNotification
FindNextPrinterChangeNotification
FindFirstPrinterChangeNotification
ScheduleJob
ReadPrinter
AbortPrinter
advapi32
DecryptFileA
GetUserNameA
dxgi
CreateDXGIFactory
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ