MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91a2438e2f0b0572836b4e501bb22141c6908746b3891a41401a7276a03c1030. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Babadeda

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	91a2438e2f0b0572836b4e501bb22141c6908746b3891a41401a7276a03c1030
SHA3-384 hash:	df4e87f0a2a1160a1413460e78444a283d095986638a00094eefcf2ae06d5cb801ff84f3b5c28e12d791a34b93f45c0d
SHA1 hash:	a536bb8003e30d8822c3fdae1a5d95f3673710ae
MD5 hash:	d97886f33e4198fa5d3d5e3f0b58f998
humanhash:	pasta-enemy-winner-twelve
File name:	ClipPlusCommunitySetup.zip
Download:	download sample
Signature	Babadeda Create hunting rule
File size:	17'807'566 bytes
First seen:	2024-01-30 21:07:55 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	393216:+3IE3UbhLj5zGiRQVvnMwh2tfn3J8bVMF0hDXdAD8OQtTKOULTu9VzbjfyNww9mg:PE3Ur4vFh29J82OXdAD8OQtT+eNfyNHV
TLSH	T1E507334EFA9B1AD1D9D766A78D501DFAB3AB3F024382461D0703B74429935D2227E3CE
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	rmceoin
Tags:	Babadeda zip

rmceoin

5.181.159.48/Downloads/ClipPlusCommunitySetup.zip

Intelligence

File Origin

# of uploads :

# of downloads :

185

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	ClipPlusCommunitySetup.msi
File size:	17'969'152 bytes
SHA256 hash:	cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d
MD5 hash:	eb64b1dbb38961bdb4c0f4b724b1ed3d
MIME type:	application/x-msi
Signature	Babadeda

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Other.Malware-gen.20184.15218.UNOFFICIAL

Verdict:

No Threat

Threat level:

2.5/10

Confidence:

100%

Tags:

installer

Link:

https://www.filescan.io/uploads/65b965340eab2d16054af1a5/reports/fa44cbf2-4db4-4fd7-b186-e58fed367213/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/91a2438e2f0b0572836b4e501bb22141c6908746b3891a41401a7276a03c1030

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/91a2438e2f0b0572836b4e501bb22141c6908746b3891a41401a7276a03c1030

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/91a2438e2f0b0572836b4e501bb22141c6908746b3891a41401a7276a03c1030/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sgrehdrpbmcxfa3ljzibxmrbihdjbb2gwoeruqkadjzhnib4caya._file

Result

Malware family:

babadeda

Score:

10/10

Tags:

family:babadeda crypter loader

Link:

https://tria.ge/reports/240130-1svbaaeffn/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

Drops file in Windows directory

Blocklisted process makes network request

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Babadeda

Babadeda Crypter

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/91a2438e2f0b0572836b4e501bb22141c6908746b3891a41401a7276a03c1030

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.