MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Babadeda

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d
SHA3-384 hash:	35069ac456ea4a25fa96dd976286050d13f57cda1c076783feeb4f79eabba3f1b91a6d98f33ad34fff0a5605ec9a08b8
SHA1 hash:	a375bc847388cdddc6cffd57dc7f0c3d6be72cdf
MD5 hash:	eb64b1dbb38961bdb4c0f4b724b1ed3d
humanhash:	undress-undress-wyoming-oxygen
File name:	ClipPlusCommunitySetup.msi
Download:	download sample
Signature	Babadeda Create hunting rule
File size:	17'969'152 bytes
First seen:	2024-01-30 21:09:07 UTC
Last seen:	2024-01-31 01:27:49 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	393216:QnEbwdw5PBbXDqPiHNTS3ByWhGhz3iQw0FHufQMfh1GD6QGhNgqx9OPNQNI62vho:pbwdwnBtcFhG1w0MVZ1GD6QGhNpwsIne
TLSH	T14807334AFF82DEC2E96B51778D908669F57B3D0149850D092B91BB382CB33D8327F586
TrID	88.4% (.MST) Windows SDK Setup Transform script (61000/1/5) 11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter	rmceoin
Tags:	Babadeda msi signed

Code Signing Certificate

Organisation:	Crystal Office Systems
Issuer:	Crystal Office Systems
Algorithm:	sha1WithRSAEncryption
Valid from:	2024-01-30T18:40:22Z
Valid to:	2025-01-30T00:40:22Z
Serial number:	259ba2145eadd0964bdd0124232629e8
Thumbprint Algorithm:	SHA256
Thumbprint:	bd265d61903469eb00d92b70bc932461475c9d7cdfc3f5162ea306db0cfc8b5c
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

rmceoin

5.181.159.48/Downloads/ClipPlusCommunitySetup.zip

Intelligence

File Origin

# of uploads :

# of downloads :

138

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Other.Malware-gen.20184.15218.UNOFFICIAL

Verdict:

No Threat

Threat level:

2.5/10

Confidence:

100%

Tags:

installer

Link:

https://www.filescan.io/uploads/65b965ad7ddeff640e47290a/reports/b06e68c7-850d-4306-a0a0-c031939af46b/overview

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d

Result

Threat name:

LummaC, Babadeda, LummaC Stealer, Petite

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1383639

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

PE file has a writeable .text section

PE file has nameless sections

Query firmware table information (likely to detect VMs)

Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Babadeda

Yara detected LummaC Stealer

Yara detected Petite Virus

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z5owy2ebd435tlq2ttdcvpazq765reane4p5via5jkcikpl5wegq._file

Verdict:

malicious

Result

Malware family:

babadeda

Score:

10/10

Tags:

family:babadeda crypter loader

Link:

https://tria.ge/reports/240130-zz17qscdb6/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

Program crash

Drops file in Windows directory

Blocklisted process makes network request

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Babadeda

Babadeda Crypter

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.