MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46e406fe4b978a36a98282420eed3c40ddb1c3818575015f9980597e770513d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Babadeda


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46e406fe4b978a36a98282420eed3c40ddb1c3818575015f9980597e770513d3
SHA3-384 hash: e754f67d38cae6c12289e35eb3a4730c8a5c015778c9de47c89715dc89d367bd3a3fcd8fb688437bebee334278ec0cff
SHA1 hash: 7cd287a57128cb071b6bd80eb0f1054756104ea6
MD5 hash: db3db5115c1e8b1efc0c8a9830be818c
humanhash: edward-lactose-magnesium-mirror
File name:file
Download: download sample
Signature Babadeda
Create hunting rule
File size:21'128'184 bytes
First seen:2022-11-21 18:54:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9369b8cbf820fedf4c7837b944ee2543 (8 x Babadeda, 1 x Amadey)
ssdeep 393216:QaTLRoWAS5a0N7ux+7Pi0+odWwdazIawx1Vf9BRgZw2TsuQ:QELRoWt5n9EsPjdWwuA1V1BGZD2
Threatray 54 similar samples on MalwareBazaar
TLSH T15A2733183AF0BEF5F8E7A1BB154B2941713051693AD30CDFB42971DA3302E685ECAA75
TrID 63.4% (.EXE) UPX compressed Win32 Executable (27066/9/6)
10.5% (.EXE) Win32 Executable (generic) (4505/5/1)
7.0% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
4.8% (.EXE) Win16/32 Executable Delphi generic (2072/23)
4.7% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 2e2e5630adc9ce48 (12 x Babadeda)
Reporter jstrosch
Tags:Babadeda exe signed

Code Signing Certificate

Organisation:James Caulfield
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2020-08-11T00:00:00Z
Valid to:2023-08-11T23:59:59Z
Serial number: 967cb0898680d1c174b2baae5fa332db
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: c231f1e6cc3aec983d892e1bc3bb1815335fb24e3e2f611d79bade9a07cbd819
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-21 18:56:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ab4f0dc5-6764-4fc3-83ca-e51a32e22ceb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Adware.Dealply-6619273-0
Create hunting rule

PUA.Win.Adware.Dealply-6888374-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Delayed reading of the file
Creating a file in the %temp% subdirectories
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
exploit greyware overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/637bc989e64742f53c1078c4/reports/7f6af939-eb23-44c5-b30c-d396fe94020d/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
Babadeda
Create hunting rule
Detection:
suspicious
Classification:
troj
Score:
28 / 100
Link:
https://www.joesandbox.com/analysis/1118423
Signature
Multi AV Scanner detection for submitted file
Yara detected Babadeda
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2022-11-20 23:59:09 UTC
File Type:
PE (Exe)
Extracted files:
1507
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i3san7sls6fdnkmcqjba53j4ido3dq4bqv2qcx4zqbmx45yfcpjq._file
Verdict:
malicious
Similar samples:
06089228420b587517a8674d586b6a2880b939d15775ca8e0a64c4364daadeed
Babadeda
1a98be3c94ae7a5f690fbed35341b989b8a28132f59784bb68ec91a1c850666d
Babadeda
37056d95d8a40efef2409cc81894bb294a063a51ab152401f4dab83817b11013
Babadeda
3faabdca1f4040c7f6038c8532542316562b4c8febe4f4a2b2671dbe103305bd
Babadeda
925b2a6cffe8f4835e1fd4db52b33a863adc953be537638be28462c82389e9e0
Babadeda
a6d25755fa8924d8df0ccbf885516f13ab602bae86462388cc146e8e5191cece
Babadeda
e6cc9c8fdeb23608fb3566df3fb8ada07aac8a9fc5e333303fdb3db730a5b5e8
Babadeda
eb67f3f67c1959e1921e8f4837d96cbb71c0063e4eadfe5260c90e0c4f477c84
Babadeda
+ 44 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/221121-xkskyada53/
Behaviour
Enumerates physical storage devices
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/46e406fe4b978a36a98282420eed3c40ddb1c3818575015f9980597e770513d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Babadeda

Executable exe 46e406fe4b978a36a98282420eed3c40ddb1c3818575015f9980597e770513d3

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2423779/

Comments