babylonrat | c0fe16b18acd24d2c5d25aca50ec74ef4037b64c06d1fece82fdb26435ee4846

General

Target
2026-10-17_f13dd830c762a87cb4ee484e3274968a_coinminer_elex_karagany_manuscrypt_maze_rhadamanthys_stealc_stop
Size 803KB
Sample261018-b3yzsazs7k
SHA256 c0fe16b18acd24d2c5d25aca50ec74ef4037b64c06d1fece82fdb26435ee4846
MD5 f13dd830c762a87cb4ee484e3274968a
SHA1 0be496d3879e4f4e26b3a92cde081eab3dd77681
SHA512 0345e76918652b4ae34913e319d2a7964886ffaf31fb43c5bfe72216f5281f90f040ef7bc8a97e626e4a74baf1d74ba2015c734f357aad1310fa2b902e5eabe7
SSDEEP 24576:AhvZpBDwzQ9Xv0HfEObq6x6bfYBcu0ZbzVgU:S76Q9Xv0HfEObJxufYBcu0ZbzVg
TLSH
T1DC05BF1376D2C032C4A301B192799F226EBEFE310A35989BA7C8194D1EB45C1EB6F757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

babylonrat

C2

192.168.5.211
90.190.160.51

Targets

- Target
  2026-10-17_f13dd830c762a87cb4ee484e3274968a_coinminer_elex_karagany_manuscrypt_maze_rhadamanthys_stealc_stop
- Size 803KB
- SHA256 c0fe16b18acd24d2c5d25aca50ec74ef4037b64c06d1fece82fdb26435ee4846
- MD5 f13dd830c762a87cb4ee484e3274968a
- SHA1 0be496d3879e4f4e26b3a92cde081eab3dd77681
- SHA512 0345e76918652b4ae34913e319d2a7964886ffaf31fb43c5bfe72216f5281f90f040ef7bc8a97e626e4a74baf1d74ba2015c734f357aad1310fa2b902e5eabe7
- SSDEEP 24576:AhvZpBDwzQ9Xv0HfEObq6x6bfYBcu0ZbzVgU:S76Q9Xv0HfEObJxufYBcu0ZbzVg
- TLSH
  T1DC05BF1376D2C032C4A301B192799F226EBEFE310A35989BA7C8194D1EB45C1EB6F757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery babylonrat trojan upx
- Babylon RAT payload
- Family: Babylon RAT
  Babylon RAT is remote access trojan written in C++.
  trojan babylonrat
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Babylon RAT payload

Family: Babylon RAT

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

UPX dump on OEP (original entry point)

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2