MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eda69c9baceb0b4fc02c469aac89bc73b006efb2041390eb4270e56a8ced0265. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Babadeda


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eda69c9baceb0b4fc02c469aac89bc73b006efb2041390eb4270e56a8ced0265
SHA3-384 hash: b1d6e335ec856fcdc1a32b0a695836a929867192e9a30f79288feac3a085faeb850a70a64d3fda0745e5f419fc02fd27
SHA1 hash: affbf9d0b190dbb9d7777d679ba37d62a6b0bbb9
MD5 hash: 9f718c96db16686b050cdb95e0e5fa26
humanhash: freddie-ten-may-robin
File name:64097802.exe
Download: download sample
Signature Babadeda
Create hunting rule
File size:379'800 bytes
First seen:2022-03-22 05:24:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5877688b4859ffd051f6be3b8e0cd533 (119 x Babadeda, 2 x DCRat, 2 x RedLineStealer)
ssdeep 6144:2zBkLL2NTBD29tf4pRnLlWBvFdEjE8qogw+av8jfyTUyFmI4730bLedO7RZdCGCT:2KyNTx29KPnLlWBtX8qFLaEuQWL/bLbi
Threatray 122 similar samples on MalwareBazaar
TLSH T1E984F141A39550B3EAE2513202F1F02FE979A2599B14DDD7C38DB8429E423D29B783FD
Reporter adm1n_usa32
Tags:Babadeda exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
210
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
BBDD.zip
Verdict:
No threats detected
Analysis date:
2022-03-22 07:04:53 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6c6a4bcd-cef7-43b0-b1fa-da2fcd683678

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/253997/
Detection(s):
SecuriteInfo.com.BAT.KillWin.dropper.1184.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Creating a window
Sending an HTTP GET request
DNS request
Query of malicious DNS domain
Sending a TCP request to an infection source
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/10341/overview
Behaviour
MalwareBazaar
CPUID_Instruction
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/62395db50cd58dbd92d41acb/reports/65b85bc9-dfaf-41ba-a705-ffd0e015eb1f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2b82d0c2-95aa-4842-8e37-adcb834c511b
Result
Threat name:
Babadeda
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
63 / 100
Link:
https://www.joesandbox.com/analysis/961387
Signature
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses BatToExe to download additional code
Yara detected Babadeda
Yara detected BatToExe compiled binary
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 593866 Sample: 64097802.exe Startdate: 22/03/2022 Architecture: WINDOWS Score: 63 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected Babadeda 2->30 32 Machine Learning detection for sample 2->32 34 Yara detected BatToExe compiled binary 2->34 7 64097802.exe 9 2->7         started        process3 file4 24 C:\Users\user\AppData\Local\Temp\...\extd.exe, PE32 7->24 dropped 36 Detected unpacking (overwrites its own PE header) 7->36 11 cmd.exe 3 7->11         started        signatures5 process6 signatures7 38 Uses BatToExe to download additional code 11->38 14 extd.exe 1 11->14         started        17 extd.exe 2 11->17         started        20 extd.exe 2 11->20         started        22 2 other processes 11->22 process8 dnsIp9 40 Multi AV Scanner detection for dropped file 14->40 26 transfer.sh 144.76.136.153, 443, 49745, 49747 HETZNER-ASDE Germany 17->26 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eda69c9baceb0b4fc02c469aac89bc73b006efb2041390eb4270e56a8ced0265/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-02-21 06:26:00 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
20 of 27 (74.07%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
001d44ce5590b27ee8ce45ef7426722cce535c748992c6be977f693c5dd24b46
Babadeda
266a45969422bf72c70f51789a21f70f175f12a1e8b387b0dfcf6bf3f71c68e4
Babadeda
39233ad29392ccae0a5f1a13569d11baf3b942b57dd01de2ec15288beb8ec02c
Babadeda
4710c5debc1ad17a85ef82676a4b6b7e15054966de57b0f4bab61c4ede209830
Babadeda
55d3824935af6618ca3acfa8929c8f3725e2fb462b40c064bf9d666dff935acc
Babadeda
68468e56e132b170aabb28e2868b1dbd0bf40f14c0b0406fe78ad3c71ce9f527
Babadeda
6e34f951634493ec7a71e5c3418ed7d973ffc87351a5459722e04016c94b1471
Babadeda
98eaad7740c03a9ebdf1c694333de75adf6edab153bc6457d354d2a6457d093f
Babadeda
cd44397176993e5f5f33754c4300b5735f3fd7859506d0647689aa7759ebe9cc
Babadeda
ed770464373d7578963c4f42cacca5e9b3094443a1666d1fa02fad0f4420f4f9
Babadeda
+ 112 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
suricata upx
Link:
https://tria.ge/reports/220322-f4bcbsaghr/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Checks computer location settings
Executes dropped EXE
UPX packed file
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Unpacked files
SH256 hash:
a00763ba1d6076303f52ffa7ee03c06d5f4a42fc62691aef0318b0274e88cb83
MD5 hash:
fe723b96ec6211f4d991c3961ab69d37
SHA1 hash:
b30139b8231d81008288da94daf0671fe06fd849
Link:
https://www.unpac.me/results/31441dbf-714c-42e1-bf6b-f9081237cab0/
SH256 hash:
eda69c9baceb0b4fc02c469aac89bc73b006efb2041390eb4270e56a8ced0265
MD5 hash:
9f718c96db16686b050cdb95e0e5fa26
SHA1 hash:
affbf9d0b190dbb9d7777d679ba37d62a6b0bbb9
Link:
https://www.unpac.me/results/31441dbf-714c-42e1-bf6b-f9081237cab0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.08
Link:
https://yomi.yoroi.company/submissions/eda69c9baceb0b4fc02c469aac89bc73b006efb2041390eb4270e56a8ced0265

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Babadeda

Executable exe eda69c9baceb0b4fc02c469aac89bc73b006efb2041390eb4270e56a8ced0265

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/253997/
  
URLhaus
https://urlhaus.abuse.ch/url/2072511/
  
Delivery method
Distributed via web download

Comments