Overview

overview

10

Static

static

10

ws4.exe

windows7-x64

10

ws4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ws4.exe

  • Size

    355KB

  • Sample

    250314-w2mkkswxex

  • MD5

    474885a0b7d7ce32f93b1b141f716a6b

  • SHA1

    d3b796ebc8b1121a80972d6d5bb3bcfecefce3ef

  • SHA256

    cb831ca08798bcea49874f81a7fe08368c057bd3bf9d1bfba6d7bb92fa61c4c1

  • SHA512

    6a05d281970222ebb7868ba0653ac64ef3973cd62165da78404cb5a7589b977be0a01b4bd5c3d7e4d2210fefef1e4de340741e912bf8532cb7bd2a7184bb371b

  • SSDEEP

    6144:RL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19K:RLdcfxaeM6fy/KaVUtgKkTZ73coNRJ

Score
10/10
babylonratdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      ws4.exe

    • Size

      355KB

    • MD5

      474885a0b7d7ce32f93b1b141f716a6b

    • SHA1

      d3b796ebc8b1121a80972d6d5bb3bcfecefce3ef

    • SHA256

      cb831ca08798bcea49874f81a7fe08368c057bd3bf9d1bfba6d7bb92fa61c4c1

    • SHA512

      6a05d281970222ebb7868ba0653ac64ef3973cd62165da78404cb5a7589b977be0a01b4bd5c3d7e4d2210fefef1e4de340741e912bf8532cb7bd2a7184bb371b

    • SSDEEP

      6144:RL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19K:RLdcfxaeM6fy/KaVUtgKkTZ73coNRJ

    Score
    10/10
    babylonratdiscoverypersistencetrojanupx

    • Babylon RAT

      Babylon RAT is remote access trojan written in C++.

      trojanbabylonrat

    • Babylonrat family

      babylonrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks