File name:

Babylon RAT v1.6.0.0 Cracked.zip

Full analysis: https://app.any.run/tasks/e310a2cc-d52e-4f20-bdc6-558f8132e756
Verdict: Malicious activity
Analysis date: February 25, 2021, 13:44:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

81AA9F5DAF1412B3DAC2A92D4A410428

SHA1:

29FCF8312DA09E3D22251B71506F9B982824C09A

SHA256:

1D24C3D1AA927CA268DDBA75ACED587C76646CABDD090B7297E9C362AE20A7E8

SSDEEP:

98304:36Yy5BH1/lcv2HKXlYTLs00yWcMUkWWs3VOI/YxU:36Yy5/rHKXO/s0LWcMUk/sl7wxU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Babylon RAT.exe (PID: 3820)
      • Babylon RAT.exe (PID: 2256)

    • Loads dropped or rewritten executable

      • Babylon RAT.exe (PID: 3820)
      • SearchProtocolHost.exe (PID: 2896)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2588)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2588)

  • INFO

    • Manual execution by user

      • Babylon RAT.exe (PID: 2256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2018:04:17 11:50:29
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Babylon RAT v1.6.0.0 Cracked/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe notepad.exe no specs babylon rat.exe no specs searchprotocolhost.exe no specs babylon rat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2132"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIb2588.2333\READ ME doublecodes.blogspot.it.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2256"C:\Users\admin\Desktop\Babylon RAT.exe" C:\Users\admin\Desktop\Babylon RAT.exe—explorer.exe
User:
admin
Company:
Babylon
Integrity Level:
MEDIUM
Description:
Babylon RAT
Exit code:
0
Version:
1.6.0.0
Modules
Images
c:\users\admin\desktop\babylon rat.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2588"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Babylon RAT v1.6.0.0 Cracked.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2896"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3820"C:\Users\admin\AppData\Local\Temp\Rar$EXb2588.3506\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\Babylon RAT.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2588.3506\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\Babylon RAT.exe—WinRAR.exe
User:
admin
Company:
Babylon
Integrity Level:
MEDIUM
Description:
Babylon RAT
Exit code:
0
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2588.3506\babylon rat v1.6.0.0 cracked\babylon rat\babylon rat.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 009
Read events
947
Write events
59
Delete events
3

Modification events

(PID) Process:(2588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2588) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2588) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Babylon RAT v1.6.0.0 Cracked.zip
(PID) Process:(2588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2588) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
7
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2588.6367\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\Babylon RAT.exe —
MD5:—
SHA256:—
2588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2588.6367\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\Changelog.txt —
MD5:—
SHA256:—
2588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2588.6367\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\ObjectListView.dll —
MD5:—
SHA256:—
2588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2588.6367\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\SharpDX.Direct2D1.dll —
MD5:—
SHA256:—
2588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2588.6367\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\SharpDX.Direct3D10.dll —
MD5:—
SHA256:—
2588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2588.6367\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\SharpDX.dll —
MD5:—
SHA256:—
2588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2588.6367\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\SharpDX.DXGI.dll —
MD5:—
SHA256:—
2588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2588.6367\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\Theme.dll —
MD5:—
SHA256:—
2588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2588.3506\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\SharpDX.dllexecutable
MD5:1EDE43C66B29696C7C6664B9FAF7E5AA
SHA256:F1F7DA12C754215D8AD2A4B987F772722FA575BB34B33856ADF5B39B28E3D5EE
2588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2588.3506\Babylon RAT v1.6.0.0 Cracked\Babylon RAT\Changelog.txttext
MD5:05915850D7AEDF64EA1142ABA7EFEBC7
SHA256:03807F8105EE10266D36784B7716E34C88DACA528AEB3C934853153455F01302
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Babylon RAT v1.6.0.0 Cracked.zip