Edit tour
Windows
Analysis Report
hKgrI6tqYx.exe
Overview
General Information
| Sample name: | hKgrI6tqYx.exerenamed because original name is a hash value |
| Original sample name: | ef17e4c80f1630b77985efca374565ae94ba9a0a30a31b2e88ffe2d51bfe599f.exe |
| Analysis ID: | 1571324 |
| MD5: | 5ebc550846b0593c0b5c962194f87c92 |
| SHA1: | 7ba72751aa4e924fdefbde7c31305594146429b4 |
| SHA256: | ef17e4c80f1630b77985efca374565ae94ba9a0a30a31b2e88ffe2d51bfe599f |
| Tags: | busquedasxurl-comexeuser-JAMESWT_MHT |
| Infos: |  |
 | |
Detection
Python Stealer, Babadeda
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Babadeda
AI detected suspicious sample
Contains functionality to infect the boot sector
Contains functionality to register a low level keyboard hook
Creates files with lurking names (e.g. Crack.exe)
Found pyInstaller with non standard icon
Machine Learning detection for dropped file
Machine Learning detection for sample
Yara detected Generic Python Stealer
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to enumerate running services
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
File is packed with WinRar
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Potential key logger detected (key state polling based)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
hKgrI6tqYx.exe (PID: 1492 cmdline: "C:\Users\ user\Deskt op\hKgrI6t qYx.exe" MD5: 5EBC550846B0593C0B5C962194F87C92) - Heart-Senders-Crackeado.exe (PID: 5960 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Heart- Senders-Cr ackeado.ex e" MD5: D134FFD0F669B1940AE13A37980B3881) 
cmd.exe (PID: 5776 cmdline: "C:\Window s\sysnativ e\cmd.exe" /c "C:\Us ers\user\A ppData\Loc al\Temp\ED AB.tmp\EDA C.tmp\EDAD .bat C:\Us ers\user\A ppData\Loc al\Temp\He art-Sender s-Crackead o.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2940 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
Heart-Sender-V1.2.exe (PID: 6960 cmdline: Heart-Send er-V1.2.ex e -pdefens ores102558 848defenso res1233sda -dC:\User s\user\App Data\Local \Temp MD5: 94B6D18D2E0E752E6B9E914D4B6BC33F) 
HeartSender.exe (PID: 3748 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\HeartS ender.exe" MD5: 7FA598F8A47A856C0F9667C22BFBE056) - cmd.exe (PID: 3504 cmdline:
"C:\Window s\sysnativ e\cmd.exe" /c "C:\Us ers\user\A ppData\Loc al\Temp\F1 C2.tmp\F1C 3.tmp\F1C4 .bat C:\Us ers\user\A ppData\Loc al\Temp\He artSender. exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 3576 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
File00.exe (PID: 6420 cmdline: config\Fil e00.exe -p EF18367A3B 80BB838CC2 BCFD1C5E59 64:zakaria a MD5: D4EA176B0DC54374ABB87A1B9409FE50) 
A1.exe (PID: 1812 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\7ZipSf x.000\A1.e xe" MD5: 9C7691FF597E9EFD7F796B31ACCB78E8)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Babadeda | According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus users. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Babadeda | Yara detected Babadeda | Joe Security | ||
| JoeSecurity_Babadeda | Yara detected Babadeda | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GenericPythonStealer | Yara detected Generic Python Stealer | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Babadeda | Yara detected Babadeda | Joe Security | ||
| JoeSecurity_Babadeda | Yara detected Babadeda | Joe Security | ||
| JoeSecurity_Babadeda | Yara detected Babadeda | Joe Security | ||
| JoeSecurity_Babadeda | Yara detected Babadeda | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
Compliance | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Static PE information: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||