Babylon 1.5.1.0.zip
- SHA256 f4a2e0b3fc325ffb40d33e797e1f538cdb514a94e6f3bc7ffa6530e21d459c6f
Behavioral task
behavioral1
Sample
Babylon 1.5.1.0/Babylon.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
Babylon 1.5.1.0/ObjectListView.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
Babylon 1.5.1.0/Theme.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
Babylon 1.5.1.0/server.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral5
Sample
Babylon 1.5.1.0/server.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
900 seconds
General
- Target Babylon 1.5.1.0.zip
- Size 5.1MB
- Sample260706-ejr9nshv61
- SHA256 f4a2e0b3fc325ffb40d33e797e1f538cdb514a94e6f3bc7ffa6530e21d459c6f
- MD5 abdc1b00469ef7b2d84d8aa9d02f968d
- SHA1 bab1b3ff99eba73a0a703fccee0d89854d2f5aa1
- SHA512 e19254a85f30ebb2eccdc2a8a4a92ceb9282631a32f6afae66594627c79658b52ddabcaabdea1c4cdfac61d03d89ffaa152b803c8917d21edfb29f988ffadbbc
- SSDEEP 98304:to0j7aKY/M+PFSOwsP+7gAtsqGktA7bx56ldRscz5L6m97wb0elMxv:to0qK7+PFSOwsPiSktA/Wt59MwelM5
- TLSH T14E4633D9B56205B809C2DB30241F396F857068CDB66DE1AC5B6909E6D6EFC6BD3F3002
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Babylon RAT
Babylon RAT is remote access trojan written in C++.
- Babylon RAT payload 2 IoCs
resource yara_rule static1/unpack001/Babylon 1.5.1.0/server.exe family_babylonrat static1/unpack002/out.upx family_babylonrat - SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
resource yara_rule static1/unpack001/Babylon 1.5.1.0/Babylon.exe SmartAssembly -
resource yara_rule static1/unpack001/Babylon 1.5.1.0/server.ex~ upx - Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/Babylon 1.5.1.0/Babylon.exe unpack001/Babylon 1.5.1.0/ObjectListView.dll unpack001/Babylon 1.5.1.0/Theme.dll unpack001/Babylon 1.5.1.0/server.exe unpack001/Babylon 1.5.1.0/server.ex~ unpack002/out.upx
File Explorer
-
Babylon 1.5.1.0.zip.zip 5.1MB
-
Babylon 1.5.1.0/Babylon.exe.exe 6.2MB
-
Babylon 1.5.1.0/ObjectListView.dll.dll 405KB
-
Babylon 1.5.1.0/Stub/stub.tc727KB
-
Babylon 1.5.1.0/Theme.dll.dll 86KB
-
Babylon 1.5.1.0/server.exe.exe 727KB
-
Babylon 1.5.1.0/server.ex~.exe 353KB
-
out.upx.exe 727KB
Babylon 1.5.1.0/Babylon.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4569687f2dd096f8559b0b2a3710ffe1f6a7374f6439e2d8559a29f33289ef62
- MD5 dda4781148b7af5ba4892c05303f5d20
- SHA1 23114ba9e30b5b39897854283f98e9c25bac2344
- SHA512 cc33a7a3fd6f5e0d4394d2cb0189b088d2c64818994d7a6758539f9d152366ca4f2debcb4dc3a68c55615764c4c3771f04c1ccbfe81f03970d5630294271ae3c
- SSDEEP 98304:Buy9sXhsWoPzSSosDlJcS2e7Csb6j9cgl3bKBKLR4R9xk7OLifNLxu2UVa:Bd+oPzSSosDlXi9/2B24TWCK
- TLSH T1B8563902FA42A4DEC1363AF974B90FCE0D318D186D5986E127397B5850B5BA3EC9D1CE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6090435
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5.8MB
Virtual Size
5.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
363KB
Virtual Size
362KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Babylon 1.5.1.0/ObjectListView.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1fa030cdd98f653fcaa109af5c48f3d58f624aa671a980628397c6c6bc6433be
- MD5 de9f71635fb8532bd5202086097c2083
- SHA1 6fafef29e6964209122555745a89ba3d1237f762
- SHA512 c82c7d79af86826fbf9f6519fd37c456017af9f77a6b05afa81a823f7a1be8a04bf2fc5ee32175a92803e9d0a34277b655571428cf655dd07abfd9d87f78568d
- SSDEEP 6144:thiBxWw1YQ0K4/INLROMAYnMj108hIrH4puTHgaNe7lVG7UGO0UOP95QvMrLi:thCx11LsI/DtnQ1YrH4puTHgOrL
- TLSH T14F944C1223D8D72EC09F0375E0654969C3F0C189B78BE7AB6E95D6BD3C43B02AD91267
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
420510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Users\Nathan\Documents\Development\Extensions\ObjectListViewDemo\ObjectListView\obj\Release\ObjectListView.pdb
mscoree
_CorDllMain
Name
.text
Size
403KB
Virtual Size
402KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Babylon 1.5.1.0/Stub/stub.tc
- SHA256 f85b1b148177990ef0a667f2d65a3da02df90a380726dee0814805a80cdf0d24
- MD5 bab1145c62e63cb32255e7b99a1e880c
- SHA1 9c7950570f7dcdc012e24e5a6fbd14182553523c
- SHA512 5ff7bb0264cc567eff6d74fde4ccfe9f8b153f258d7f27e69a7ecbc140c375306b30fe0b57c9d61a170fe3102d244a2cb0a2183bdb019f5e195316852e212e05
- SSDEEP 12288:Ec4HLBLJJR5OGrKwQ2j3VrhMYckpJ9AMB8+A8Lz2TNgXU5hOwSfVptBgZObr9AoJ:NWL9RmwdhCk39Tw3TwQfUxvbGodD
- TLSH T1F4F422E7AE920C6C7547C4468E3B54CB68E0630A8A713F7F075E21D2FA5396B80F9275
- MD5 SHA1 SHA512 SSDEEP TLSH
Babylon 1.5.1.0/Theme.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 49400f97281d4d3f084333db0e976520f95ef2b2d797e1f8fe3e795617b1ffd3
- MD5 44c4fff764e71051faed99ba7a18f608
- SHA1 cff407ce59bb37aef3b2f4569650064f71af97b6
- SHA512 c0ed97a6fa2f9e2f8d1b541dd344171907eebbfefd59345d4b59b9df32d1725c022f8671eb880bc10dbd5c4c28489361c408659ecfcca075c7c599121340f9cf
- SSDEEP 1536:k8O+YIDwzYKtrhOFCzj6MqAqHCGLAMhng70L6eTsDmW:bG6MqpHPLPh1DzW
- TLSH T1E183A5122AD8BF53D67E1174B3B30294D3B58D258123EB9D1ED474B49CBA7133A622CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
82782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Stefan\Desktop\Workspace\BabylonRAT\Theme\obj\Release\Theme.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Babylon 1.5.1.0/server.exe
- SHA256 cb1c1dec2980acb674da9b9cb077fda38cfc035a600f65c6fdc84cb8636eddb0
- MD5 a1bc035e1f5f50adc523b4042177ac5f
- SHA1 3357e4b8564ea30bf0731446f1828a1687d91ffb
- SHA512 67cab593dad9ca0e6775cba51aa271dba10e0742f5519f2e3aefe2642debd5c5ec74ad5753915a5dfa95c24e5be2ebfd9d069e40edb86d33c7d6baf14bf5f441
- SSDEEP 12288:fibwDknqjbeJb/fesPO3nG0j2RYVtmm2NrWax0VbNZxxXMILNh3paPcg:fibw4yeZ/2sP+ntjlANrWa4ZxtVg
- TLSH T1F7F4AD2275D2D036C0B301B25769AB626EBFFD310A369997A7C8194D0E345C0EF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Babylon RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
430681
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
512KB
Virtual Size
511KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
108KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=223, productName=VS2013 build 21005, version=21005,
count=76, id=225, productName=VS2013 build 21005, version=21005,
count=225, id=224, productName=VS2013 build 21005, version=21005,
count=5, id=225, version=20806,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=319, id=1, productName=Unmarked objects,
count=1, id=224, productName=VS2013 UPD3 build 30723, version=30723,
count=33, id=225, productName=VS2013 UPD3 build 30723, version=30723,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD3 build 30723, version=30723,
Babylon 1.5.1.0/server.ex~
- SHA256 053237eac05b08f032e47f64329c21e1b2c736a943ca2c14cf6925273eb4bdfe
- MD5 84bc9aa7d065b0079de880f2089cab5d
- SHA1 e74d56f605738e6833115a2f471670c33c483d3f
- SHA512 a662e23490af5489663804cf7fd8079918c4b21ab8ac2d703f976ba283845131ecdd6d80e9309aa67d119dde8e0a342700ce5622b5182395af1ec5a9353d1359
- SSDEEP 6144:QrxNmoV75uj0cpuzBWOswhfRN3KUYMLW7F5YYPT8G1VzdXuGcT531YDrK84vurbV:QfmoV78jRp0Zbh7PYYW7FRPTnD+OKurJ
- TLSH T1DD742381009FE643DD795C3DE2E4FB75CA8A509445C2AE3AD1B830F7C5672E68CDD0AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
796080
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
424KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
350KB
Virtual Size
352KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=223, productName=VS2013 build 21005, version=21005,
count=76, id=225, productName=VS2013 build 21005, version=21005,
count=225, id=224, productName=VS2013 build 21005, version=21005,
count=5, id=225, version=20806,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=319, id=1, productName=Unmarked objects,
count=1, id=224, productName=VS2013 UPD3 build 30723, version=30723,
count=33, id=225, productName=VS2013 UPD3 build 30723, version=30723,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD3 build 30723, version=30723,
out.upx
- SHA256 8c13dfc54cf57f6612f880c8762832027fafd58ea662394b8f5bdf10dcc0e720
- MD5 c750d130c05e378fe7ebd13b85bb6d79
- SHA1 2ca65cbfee29a1bf230bb42ace2896ef09cfdd7f
- SHA512 93887ef4de89bf80558d587f1d50b4ece818e9f1fe377ee180598f21624ecfc2d2328422b94ff21e1e66eea1022c9090a26210011ee0b05ee0353e4fe41eac26
- SSDEEP 12288:xibwDknqjbeJb/fesPO3nG0j2RYVtmm2NrWax0VbKZxxXMILNa3paPcg:xibw4yeZ/2sP+ntjlANrWazZxsVg
- TLSH T126F4AD2276D2D036C0B301B25769AB526EBFFD310A369997A7C8194D1E345C0EF3A727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Babylon RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
430681
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
512KB
Virtual Size
511KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
108KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=223, productName=VS2013 build 21005, version=21005,
count=76, id=225, productName=VS2013 build 21005, version=21005,
count=225, id=224, productName=VS2013 build 21005, version=21005,
count=5, id=225, version=20806,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=319, id=1, productName=Unmarked objects,
count=1, id=224, productName=VS2013 UPD3 build 30723, version=30723,
count=33, id=225, productName=VS2013 UPD3 build 30723, version=30723,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD3 build 30723, version=30723,