Edit tour
Windows
Analysis Report
JxrkpYVdCp.exe
Overview
General Information
| Sample name: | JxrkpYVdCp.exerenamed because original name is a hash value |
| Original sample name: | 82655c7ac62d521d23570d2f580bf271a5b05076243bef23af94eb54a4adf1e7.exe |
| Analysis ID: | 1571335 |
| MD5: | e5071620968ce5efcb3072602e13cc0e |
| SHA1: | 75a37e927edcc5f79f8c6b041a9eccb848871e07 |
| SHA256: | 82655c7ac62d521d23570d2f580bf271a5b05076243bef23af94eb54a4adf1e7 |
| Tags: | busquedasxurl-comexeuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
Python Stealer, Babadeda
| Score: | 84 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Babadeda
AI detected suspicious sample
Found pyInstaller with non standard icon
Yara detected Generic Python Stealer
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
File is packed with WinRar
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Use Short Name Path in Command Line
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
JxrkpYVdCp.exe (PID: 2708 cmdline: "C:\Users\ user\Deskt op\JxrkpYV dCp.exe" MD5: E5071620968CE5EFCB3072602E13CC0E) - instal.exe (PID: 2064 cmdline:
"C:\Users\ user~1\App Data\Local \Temp\inst al.exe" MD5: 1A845FA84D4C68507FA7B39F8436DAC6) 
cmd.exe (PID: 6936 cmdline: "C:\Window s\sysnativ e\cmd.exe" /c "C:\Us ers\user\A ppData\Loc al\Temp\5B 12.tmp\5B2 2.tmp\5B23 .bat C:\Us ers\user~1 \AppData\L ocal\Temp\ instal.exe " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 4540 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - HotmailPulse-v3.1-p.exe (PID: 2268 cmdline:
HotmailPul se-v3.1-p. exe -pdefe ns123defds 123df..223 qwe -dC:\U sers\user~ 1\AppData\ Local\Temp MD5: 30475F0B0C53962EABF0D9130A297824) - HotmailPulse-v3.1.exe (PID: 6896 cmdline:
"C:\Users\ user~1\App Data\Local \Temp\Hotm ailPulse-v 3.1.exe" MD5: 5D1C90BBE14678AB16A7495E576422B9) - hotmailpulse.exe (PID: 2020 cmdline:
"C:\Users\ user~1\App Data\Local \Temp\hotm ailpulse.e xe" MD5: 6EB94393FE46226E4839EAEE0A785900) - hotmailpulse.exe (PID: 1860 cmdline:
"C:\Users\ user~1\App Data\Local \Temp\hotm ailpulse.e xe" MD5: 6EB94393FE46226E4839EAEE0A785900)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Babadeda | According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus engines. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Babadeda | Yara detected Babadeda | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GenericPythonStealer | Yara detected Generic Python Stealer | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Babadeda | Yara detected Babadeda | Joe Security | ||
| JoeSecurity_Babadeda | Yara detected Babadeda | Joe Security |
| Source: | Author: frack113, Nasreddine Bencherchali: | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
Compliance | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||