Extracted

• • Target
    Svchost.exe
  • Size 355KB
  • SHA256 bd7b0f7fbf84a68e37a222948ba4ca8491d19a20af1ce615255479ffcf1c8b12
  • MD5 4b096419c28d1d4a1d00025ef763c73b
  • SHA1 a841d7a7b5f9b4dfa3d0c718143fa65986a7eb39
  • SHA512 5066ac8ac3a8e313ad28919c19d82e064b6a0634a54c9cdd4b62822c86068e9bcf9ba68b4f641e85a00ee5287a378e738491e541fb162ab0a4ab1c94c29d527d
  • SSDEEP 6144:PL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19v++:PLdcfxaeM6fy/KaVUtgKkTZ73coNRJ2
  • TLSH
    T12274231249EA2967CDE799FC5901E5C88C37082F14DDC769DA807DFF708BAB14984DE8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverybabylonrattrojanupx

  • Babylon RAT payload

  • Family: Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2