Adware.Babylon.15

Technical Information

Malicious functions

Reads files which store third party applications passwords

%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\bab033.tbinst.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\iehelper.dll
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\htmlscreens\pbar.gif
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\htmlscreens\naverror.html
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\htmlscreens\loading.html
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\bexternal.dll
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\babylon.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\bab033.tbinst.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\setup.exe
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\kstp.txt
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\setup2.zpb
%LOCALAPPDATA%\babylon\setup\setup2.zpb
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020040620200407\index.dat
%APPDATA%\microsoft\windows\cookies\user@babylon[1].txt
%APPDATA%\babylon\log_file.txt
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\sqlite3.dll
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\setupstrings.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\setup.exe
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\iehelper.dll
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\htmlscreens\pbar.gif
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\htmlscreens\naverror.html
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\htmlscreens\loading.html
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\bexternal.dll
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\babylon.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\setupstrings.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\sqlite3.dll

Deletes the following files

%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\bab033.tbinst.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\setup.exe
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\sqlite3.dll
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\setupstrings.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\setup2.zpb
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\setup.exe
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\kstp.txt
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\iehelper.dll
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\htmlscreens\pbar.gif
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\htmlscreens\naverror.html
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\htmlscreens\loading.html
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\bexternal.dll
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\babylon.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\bab033.tbinst.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\iehelper.dll
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\htmlscreens\pbar.gif
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\htmlscreens\naverror.html
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\htmlscreens\loading.html
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\bexternal.dll
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\babylon.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\setupstrings.dat
%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\sqlite3.dll

Network activity

TCP

HTTP GET requests

http://in##.#abylon.com/stat/report.php?no#######################################################################################################################################################...
http://st###.babylon.com/?na############################################################################################
http://st###.babylon.com/js/setup.js
http://st#.#abylon.com/downloader.php?ve#########################################################################################################################################################...
http://im#.#abylon.com/site/images/stpui/img/tele/new.css
http://im#.#abylon.com/site/images/stpui/img/tele/ad_aware.png
http://dl.##bylon.com/site/files/Setup9/dwr/latest/latest_bl/Setup2.zpb
http://im#.#abylon.com/site/images/stpui/img/tele/step1.png

UDP

DNS ASK in##.#abylon.com
DNS ASK st###.babylon.com
DNS ASK st#.#abylon.com
DNS ASK im#.#abylon.com
DNS ASK dl.##bylon.com

Miscellaneous

Searches for the following windows

ClassName: 'Install Babylon' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\setup.exe' -uiname=adaware1 -affilID=118951 -xprm="pack=tc_adaware" -expg=none /brwsr=dnl
'%TEMP%\2b108f3a-bab0-7891-bf83-6ac4f2a7588b\latest\setup.exe' -latest -trkInfo=[TType:5012_7] -uiname=adaware1 -affilID=118951 -xprm="pack=tc_adaware" -expg=none /brwsr=dnl

Executes the following

'%WINDIR%\syswow64\rundll32.exe' %TEMP%\2B108F~1\IEHelper.dll,UpdateProtectedModeCookieCache URI|http://ba##lon.com
'%WINDIR%\syswow64\rundll32.exe' %TEMP%\2B108F~1\IEHelper.dll,UpdateProtectedModeCookieCache trkInfo|http://ba##lon.com