Extracted

• • Target

    c49f8fea6230da9d810dddff886709c32714ee367ed5e862194e4c33b8f7af9c

  • Size

    2.3MB

  • MD5

    6ecfb7154353d367c99380f9c8ea188a

  • SHA1

    61a862ee7812c636f7f9557afe3216b77afcf335

  • SHA256

    c49f8fea6230da9d810dddff886709c32714ee367ed5e862194e4c33b8f7af9c

  • SHA512

    17de1c67b751778b8f40fce84a5d379c207495aaf70c91bac92dd1f051e1c2f84dadda518f996827b3a723f13933454c04eb9340be4713e23cc547521c1c053b

  • SSDEEP

    24576:x1r43sfARB7U4kieI1SqjEDKcSrJIvJiu/AxWtS:Pr43o67TrXIqjbcS6vJT6WtS

  Score

  10^/10

  discoverypersistencebabylonrattrojan

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Babylonrat family

    babylonrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2