MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79c6fdedbe965a9ebf8d80f13e27332b18cdb0b313c5bb9a7c2b6723b53d3335. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Babadeda


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79c6fdedbe965a9ebf8d80f13e27332b18cdb0b313c5bb9a7c2b6723b53d3335
SHA3-384 hash: 9714b1752cf50cd6feb51f7f9dd9ea7b0c6b61f5c74daf438e64d871d38b27bfe78534859fb7d230c1ae3b3dc99e8e28
SHA1 hash: 007cea24cf45ba83d9992d76974598da5cc77017
MD5 hash: bee39fe76d04c610256938a58ac5d660
humanhash: fifteen-fanta-carolina-nitrogen
File name:file
Download: download sample
Signature Babadeda
Create hunting rule
File size:4'297'728 bytes
First seen:2023-06-11 01:54:29 UTC
Last seen:2023-06-14 05:40:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5877688b4859ffd051f6be3b8e0cd533 (119 x Babadeda, 2 x DCRat, 2 x RedLineStealer)
ssdeep 1536:E7f9h0UPJP/CpICdikMLMLv5PFNg1qrX+VIOlnToIfegIxRvEGm:6liUPXC8k1nJrX+fNTBfu
TLSH T131163841B3D742B6E6EE093200B6602B9535AA289714BDD7D37D38425972FD0AB3C3F9
TrID 36.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
19.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.4% (.EXE) Win64 Executable (generic) (10523/12/4)
7.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
5.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon d4279ad966a619c4 (1 x RedLineStealer, 1 x Babadeda)
Reporter andretavare5
Tags:Babadeda exe


Avatar
andretavare5
Sample downloaded from https://vk.com/doc228185173_661326385?hash=omsYqM7GB8lg1UwKEIXnVZyVnQHvFKMEbXDTfJjAT2X&dl=nRcQmF7z0olvdhreghxZmv8mOwbq8Zrwm32BZFAgec4&api=1&no_preview=1#check

Intelligence

File Origin
# of uploads :
9
# of downloads :
325
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-06-11 01:57:22 UTC
Tags:
opendir loader
Link:
https://app.any.run/tasks/1d3d7bd5-3f04-4a05-92e8-33344fedf9e2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/397668/
Detection(s):
SecuriteInfo.com.BAT.KillWin.dropper.1184.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Launching a process
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a window
Changing a file
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/90239/overview
Behaviour
MalwareBazaar
CPUID_Instruction
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/648529791a00b92eb0068775/reports/818a2fd7-b4db-4336-bcdb-c8a67c092c20/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/79c6fdedbe965a9ebf8d80f13e27332b18cdb0b313c5bb9a7c2b6723b53d3335
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6ac6329b-4f0f-4493-82d7-d5c71eea1603
Result
Threat name:
Babadeda
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1252480
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Yara detected Babadeda
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 885500 Sample: file.exe Startdate: 11/06/2023 Architecture: WINDOWS Score: 100 40 Multi AV Scanner detection for domain / URL 2->40 42 Antivirus detection for URL or domain 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 2 other signatures 2->46 10 file.exe 8 2->10         started        process3 signatures4 50 Detected unpacking (overwrites its own PE header) 10->50 13 cmd.exe 1 10->13         started        process5 signatures6 58 Adds a directory exclusion to Windows Defender 13->58 16 powershell.exe 15 13->16         started        18 powershell.exe 17 13->18         started        21 powershell.exe 14 16 13->21         started        25 conhost.exe 13->25         started        process7 dnsIp8 27 rFkA.exe 3 16->27         started        48 Powershell drops PE file 18->48 38 89.23.96.203, 49679, 80 MAXITEL-ASRU Russian Federation 21->38 36 C:\Users\user\AppData\Roaming\rFkA.exe, PE32 21->36 dropped file9 signatures10 process11 signatures12 52 Multi AV Scanner detection for dropped file 27->52 54 Machine Learning detection for dropped file 27->54 56 Injects a PE file into a foreign processes 27->56 30 rFkA.exe 1 27->30         started        process13 process14 32 WerFault.exe 20 9 30->32         started        34 conhost.exe 30->34         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79c6fdedbe965a9ebf8d80f13e27332b18cdb0b313c5bb9a7c2b6723b53d3335/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2023-06-11 01:55:06 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=phdp33n6sznj5p4nqdyt4jztfmmm3mftcpc3xgt4fntshnj5gm2q._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/230611-cb4xdsha7w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Unpacked files
SH256 hash:
79c6fdedbe965a9ebf8d80f13e27332b18cdb0b313c5bb9a7c2b6723b53d3335
MD5 hash:
bee39fe76d04c610256938a58ac5d660
SHA1 hash:
007cea24cf45ba83d9992d76974598da5cc77017
Link:
https://www.unpac.me/results/34420a67-661d-436a-aa81-d871a6903880/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79c6fdedbe965a9ebf8d80f13e27332b18cdb0b313c5bb9a7c2b6723b53d3335

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/397668/

Comments