babadeda

General

Target
Cloudflare_security_install.exe
Size 34.4MB
Sample250924-spdv5awpy6
SHA256 bad534540ed575c213bd34fe1f21c6ffca58169e9c9c83669749c3f6e398ea4b
MD5 e3763ad6ab1f66bfd0240db96ccdc0be
SHA1 523be6fdb9b5740146f5d24b17193cf62ff4c35f
SHA512 7c2e67ec3652dc2e38c33852720a023606a7dd0f699f7c03e263c845c88c4175b53826bc61ba44d74e2a793391ef32f653e7cbf427d2ad2d9e75cede90208253
SSDEEP 786432:SQRwdPcR5MRDY8X9XRTuCpZD7U4qRVOtIqNi0f9jphU7oDM8ETp9a6KPih:1RwdPcR5uDYg1pZfUNRctpNi0f9dhU7r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Cloudflare_security_install.exe
- Size 34.4MB
- SHA256 bad534540ed575c213bd34fe1f21c6ffca58169e9c9c83669749c3f6e398ea4b
- MD5 e3763ad6ab1f66bfd0240db96ccdc0be
- SHA1 523be6fdb9b5740146f5d24b17193cf62ff4c35f
- SHA512 7c2e67ec3652dc2e38c33852720a023606a7dd0f699f7c03e263c845c88c4175b53826bc61ba44d74e2a793391ef32f653e7cbf427d2ad2d9e75cede90208253
- SSDEEP 786432:SQRwdPcR5MRDY8X9XRTuCpZD7U4qRVOtIqNi0f9jphU7oDM8ETp9a6KPih:1RwdPcR5uDYg1pZfUNRctpNi0f9dhU7r
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

crypter defense_evasion discovery babadeda netsupport loader persistence privilege_escalation rat spyware stealer trojan
- Babadeda
  Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
  loader crypter babadeda
- Babadeda Crypter
- Babadeda family
  babadeda
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Netsupport family
  netsupport
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2