File: babe06cce15bb2e38639546737c093077787589f7809834d076395143cb24622
Metadata
| babe06cce15bb2e38639546737c093077787589f7809834d076395143cb24622.bin | |
| PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows | 1156096 bytes |
| Analyzed on December 1 2016 12:00:26 | |
| 678af4b6a7cf159209e3d469032637a4 | |
| 934b94e591a1f035cacacd242665febe7fdad59f | |
| babe06cce15bb2e38639546737c093077787589f7809834d076395143cb24622 | |
| e805e7dce0f686656c147ca2dd4489f7125ff6792740703caca2fd23bc907c1ab7d25d0822aa2fd14de053e6acdba00dfd4ae7a4fcb2da3055371f8646831b98 | |
| 24576:3AQE2D9CqaUbvACzyz2jQqoGOJBWoSw5t25Sd:8UbvACyqp7oSGtH | |
| f34d5f2d4577ed6d9ceec516c1f5a744 | |
| 06b5092b1ee3477d6c6e5807d79ae2c31b8162c7f3d12949dcb9491dd7141310 | |
APTNotes
Cyber threat intelligence reports associated with babe06cce15bb2e38639546737c093077787589f7809834d076395143cb24622.
Cyber threat intelligence reports associated with babe06cce15bb2e38639546737c093077787589f7809834d076395143cb24622.
Domains
Domains the malware sample communicates with.
Domains the malware sample communicates with.
Hosts
Hosts the malware sample communicates with.
Hosts the malware sample communicates with.
HTTP Requests
HTTP requests the malware sample makes.
HTTP requests the malware sample makes.
AV Detections
AV detection names associated with the malware sample.
AV detection names associated with the malware sample.
Mutants
Mutants created by the malware sample.
Mutants created by the malware sample.
| "\Sessions\1\BaseNamedObjects\777ourmutex777" |
| "\Sessions\1\BaseNamedObjects\.NET CLR Data_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\.NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\.NET Data Provider for Oracle_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\.NET Data Provider for SqlServer_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\.NET Memory Cache 4.0_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\.NETFramework_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\ASP.NET_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\ASP.NET_4.0.30319_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\aspnet_state_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\BITS_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\ESENT_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\Lsa_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\MSDTC_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\MSSCNTRS_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\Outlook_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\PerfDisk_Perf_Library_Lock_PID_bec" |
| "\Sessions\1\BaseNamedObjects\PerfNet_Perf_Library_Lock_PID_bec" |
Registry keys
Registry keys created by the malware sample.
Registry keys created by the malware sample.
Comments
User comments about babe06cce15bb2e38639546737c093077787589f7809834d076395143cb24622.
User comments about babe06cce15bb2e38639546737c093077787589f7809834d076395143cb24622.
