Technical Information
Malicious functions
Searches for registry branches where third party applications store passwords
- [HKLM\Software\Microsoft\IdentityCRL]
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\bab016.v10ttl.dat
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\bab049.cbid050812.dat
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\bab066.abtstr.dat
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\bab307.sp_pop0.dat
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\babylon.dat
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\bexternal.dll
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\iehelper.dll
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\bab327.ff_2.dat
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\setup.ico
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\setupstrings.dat
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\sqlite3.dll
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\setup.exe
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\bab456.tb_oldway.dat
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\bab025.no_welc_scr.dat
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\htmlscreens\loading.html
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\htmlscreens\naverror.html
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\htmlscreens\pbar.gif
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\bab222.5ftt.dat
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\gtngstrtd.aoi
- %TEMP%\cookies.tmp
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %LOCALAPPDATA%\microsoft\windows\history\desktop.ini
- %LOCALAPPDATA%\babylon\setup\default-clientdat.zpb
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\default-clientdat.zpb
- %LOCALAPPDATA%\microsoft\windows\inetcookies\deprecated.cookie
- %LOCALAPPDATA%\babylon\setup\setup-tbdef.zpb
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\setup-tbdef.zpb
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6947045d-1200.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69470460-118c.pma
Deletes following files that it created itself
- %TEMP%\cookies.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\h41f71xv\default-clientdat[1].htm
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\default-clientdat.zpb
- %LOCALAPPDATA%\babylon\setup\default-clientdat.zpb
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\tlu87c1s\default-clientdat[1].htm
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\h41f71xv\setup-tbdef[1].htm
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\setup-tbdef.zpb
- %LOCALAPPDATA%\babylon\setup\setup-tbdef.zpb
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\tlu87c1s\setup-tbdef[1].htm
Moves the following files
- from %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\gtngstrtd.aoi to %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\gtngstrtd.inf
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Substitutes the following files
- %TEMP%\cookies.tmp
- %LOCALAPPDATA%\babylon\setup\default-clientdat.zpb
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\default-clientdat.zpb
- %LOCALAPPDATA%\babylon\setup\setup-tbdef.zpb
- %TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\setup-tbdef.zpb
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Network activity
Connects to
- 'st##.##fo-stream.net':80
- 'st#.#abylon.com':80
- 'st###.babylon.com':80
- 'dl.##bylon.com':80
- '92.##3.97.97':80
- 'af###nic.com':443
- 'co####.edge.skype.com':443
TCP
HTTP GET requests
- http://st#.#abylon.com/downloader.php?ve#########################################################################################################################################################...
- http://st###.babylon.com/lander?bl##################################################################################
Other
- 'af###nic.com':443
- 'co####.edge.skype.com':443
UDP
- DNS ASK st##.##fo-stream.net
- DNS ASK st#.#abylon.com
- DNS ASK st###.babylon.com
- DNS ASK dl.##bylon.com
- DNS ASK af###nic.com
- DNS ASK co####.edge.skype.com
Miscellaneous
Searches for the following windows
- ClassName: 'Babylon' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Creates and executes the following
- '%TEMP%\0ed976f0-bab0-7891-8337-49f0c1cd25d2\setup.exe' -wbr=512 -xprm="cat=ggl_frc&ours=1" /mtb=0
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' %TEMP%\0ED976~1\IEHelper.dll,UpdateProtectedModeCookieCache affilID|http://babylon.com
- '%WINDIR%\syswow64\rundll32.exe' %TEMP%\0ED976~1\IEHelper.dll,UpdateProtectedModeCookieCache trkInfo|http://babylon.com
- '%ProgramFiles(x86)%\internet explorer\ielowutil.exe' -PID:123
- '%WINDIR%\syswow64\rundll32.exe' %TEMP%\0ED976~1\IEHelper.dll,UpdateProtectedModeCookieCache visitorID|http://babylon.com
- '%ProgramFiles(x86)%\internet explorer\ielowutil.exe' -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
- '%ProgramFiles%\internet explorer\iexplore.exe' -Embedding
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\bho\ie_to_edge_stub.exe' --from-ie-to-edge=3 --ie-frame-hwnd=c01e8
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=c01e8
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=c01e8 --flag-switches-begin --flag-switches-end --do-not-de-elevate
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=c01e8 --flag-switches-begin --flag-switches-end --do-not-de-elevate' (with hidden window)
