MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e34f951634493ec7a71e5c3418ed7d973ffc87351a5459722e04016c94b1471. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Babadeda


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e34f951634493ec7a71e5c3418ed7d973ffc87351a5459722e04016c94b1471
SHA3-384 hash: 273685aeaddfaf656544b98a90e948593f5b578487c4be54bd447dfcea70f4ad8e21d967e1b2398e4d1aa3829fbe3fbc
SHA1 hash: f5f6c26e8c88935bddd0fd7ebd63368814eabe9d
MD5 hash: 0572dadb863614d866f14d0c6afaf2f8
humanhash: oxygen-vermont-bakerloo-kitten
File name:80100072.exe
Download: download sample
Signature Babadeda
Create hunting rule
File size:355'328 bytes
First seen:2022-03-21 06:51:01 UTC
Last seen:2022-03-22 05:23:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5877688b4859ffd051f6be3b8e0cd533 (119 x Babadeda, 2 x DCRat, 2 x RedLineStealer)
ssdeep 6144:bldk1cWQRNTB4l+8kJkbl+EFs1lVJ7+wjLzylPagB1UvnpNucpZ6/DAlcAgp:bcv0NTuV1i1Bywj6lv4hpZ0DAe
Threatray 117 similar samples on MalwareBazaar
TLSH T157740245F6E340F6FAE2067110A9B37BA33566349B24A8D7C34C3C429953AC09E793F9
Reporter adm1n_usa32
Tags:Babadeda exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
181
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/253298/
Detection(s):
SecuriteInfo.com.Malware.AI.392946571.12299.9836.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Creating a window
Sending an HTTP GET request
DNS request
Sending a custom TCP request
Query of malicious DNS domain
Sending a TCP request to an infection source
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/10014/overview
Behaviour
MalwareBazaar
CPUID_Instruction
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed shell32.dll
Link:
https://www.filescan.io/uploads/6238205d0cd58dbd92cc9980/reports/e8951bbc-7901-47e5-af02-28ecea79f0a2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/c226a650-e195-4107-9aa0-75235b215241
Result
Threat name:
Babadeda
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/960462
Signature
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses BatToExe to download additional code
Yara detected Babadeda
Yara detected BatToExe compiled binary
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 592942 Sample: 80100072.exe Startdate: 21/03/2022 Architecture: WINDOWS Score: 84 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected Babadeda 2->30 32 Machine Learning detection for sample 2->32 34 Yara detected BatToExe compiled binary 2->34 7 80100072.exe 9 2->7         started        process3 file4 24 C:\Users\user\AppData\Local\Temp\...\extd.exe, PE32 7->24 dropped 36 Detected unpacking (overwrites its own PE header) 7->36 11 cmd.exe 3 7->11         started        signatures5 process6 signatures7 38 Uses BatToExe to download additional code 11->38 14 extd.exe 1 11->14         started        17 extd.exe 2 11->17         started        20 extd.exe 2 11->20         started        22 2 other processes 11->22 process8 dnsIp9 40 Multi AV Scanner detection for dropped file 14->40 26 transfer.sh 144.76.136.153, 443, 49771, 49778 HETZNER-ASDE Germany 17->26 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e34f951634493ec7a71e5c3418ed7d973ffc87351a5459722e04016c94b1471/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-03-05 20:31:42 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
001d44ce5590b27ee8ce45ef7426722cce535c748992c6be977f693c5dd24b46
Babadeda
0728b1603407e57a7f30b16bb706dfaa69439b16181178fca3f3852a91bd208e
Babadeda
39233ad29392ccae0a5f1a13569d11baf3b942b57dd01de2ec15288beb8ec02c
Babadeda
4710c5debc1ad17a85ef82676a4b6b7e15054966de57b0f4bab61c4ede209830
Babadeda
68468e56e132b170aabb28e2868b1dbd0bf40f14c0b0406fe78ad3c71ce9f527
Babadeda
83ae57bdc0f817111ab909f54ec0f33b84f6504596d2a55adf39a16c5cf1afc0
Babadeda
98eaad7740c03a9ebdf1c694333de75adf6edab153bc6457d354d2a6457d093f
Babadeda
9e1565a4e0af404cf7eb096a60ddb70b5d5adf849312ea6f76c6374841759166
Babadeda
ed770464373d7578963c4f42cacca5e9b3094443a1666d1fa02fad0f4420f4f9
Babadeda
f04b77c60c896b33ed8fe286de3341fc3ffd0211a987435475dc7e9d0abcb0cc
Babadeda
+ 107 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
suricata upx
Link:
https://tria.ge/reports/220321-hmhq7aaack/
Behaviour
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Executes dropped EXE
UPX packed file
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
Unpacked files
SH256 hash:
2b48cfb451f39324f0518661388d2fc8fc18e9629054337e075ddd1d11709c53
MD5 hash:
42ee6525fa955efd86f114ef3a31fcbb
SHA1 hash:
6ae56864ed2a0295f76e6643397ac63a7db8059d
Link:
https://www.unpac.me/results/a81e1df7-bad1-4bb0-8741-5483a7100b9c/
SH256 hash:
6e34f951634493ec7a71e5c3418ed7d973ffc87351a5459722e04016c94b1471
MD5 hash:
0572dadb863614d866f14d0c6afaf2f8
SHA1 hash:
f5f6c26e8c88935bddd0fd7ebd63368814eabe9d
Link:
https://www.unpac.me/results/a81e1df7-bad1-4bb0-8741-5483a7100b9c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e34f951634493ec7a71e5c3418ed7d973ffc87351a5459722e04016c94b1471

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/253298/

Comments