6 minhigh
BabylonRat Technical Analysis Report
BabylonRAT is an open-source Windows RAT impersonating Firefox, using dynamic API resolution and XOR obfuscation to persist, steal browser credentials, keylog, and execute 20 distinct C2 commands. BabylonRAT resolves Windows APIs dynamically via GetProcAddress and XOR-obfuscates function pointers to evade static analysis. It persists by copying itself to a hidden ProgramData directory and registering in RunOnce. A 20-command C2 framework enables screenshots, keylogging, browser credential extraction, DoS, remote shell, and hosts file modification.
Sens:▲ 24hConf:high
IOCs9
3file path2filename1domain1md51registry key1sha256
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block DNS resolution for gsx.uk.com at perimeter and internal resolvers
- Hunt for C:\ProgramData\Firefox\Leon.exe and RunOnce value named 'gsx' across endpoints
- Quarantine any host with the SHA256 hash 2f61950c3baa58573fac514205cead5afd6e27e84bb2b91b233a9f045d9b3f4c
Key Takeaways
- Malware sample masquerades as Mozilla Firefox (799 KB PE32) with MD5 72999C0DA0454511B066547206ED7A58.
- Drops a persistent copy as C:\ProgramData\Firefox\Leon.exe with hidden attributes set.
- RunOnce registry value named 'gsx' ensures Leon.exe auto-executes at next user logon.
- C2 server domain gsx.uk.com contacted over HTTP; 20 command IDs control screenshots, DoS, credential theft, and remote shell.
- Browser credentials stolen from Chrome and Firefox SQLite logins tables via command 16.
Attack Chain
- Initial Access: User executes Firefox.exe masquerading as Mozilla Firefox browser
- Persistence: Copies itself to C:\ProgramData\Firefox\Leon.exe with hidden attributes; sets RunOnce registry value 'gsx'
- Defense Evasion: Removes Zone.Identifier MOTW data; uses dynamic API resolution with XOR-obfuscated pointers
- Discovery: Collects OS info, username, computer name, locale, drive enumeration via WMI and Win32 APIs
- Collection: Keylogs to ClipBoard.txt via SetWindowsHookEx; steals Chrome and Firefox credentials from SQLite logins
- C2 and Exfiltration: Beacons to gsx.uk.com; 20 commands enable screenshots, DoS, remote shell, file download, hosts file modification
Affected Systems
- Windows XP 32-bit (compilation target)
- Windows desktop systems (general)
- Google Chrome and Mozilla Firefox browser profiles
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | Process creation, registry writes, API hooking, and file operations are observable via EDR telemetry. |
| Network Visibility | Medium | C2 over HTTP to gsx.uk.com visible at network edge; payload encryption limits content inspection. |
| Detection Difficulty | Moderate | Dynamic API resolution and XOR obfuscation hinder static analysis, but behavioral patterns are distinct. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| PE executables creating hidden directories under ProgramData and copying themselves with SetFileAttributesW (T1564.001) | Sysmon EID 11, EID 1 with hidden attribute flags | Persistence | Low — legitimate installers rarely hide ProgramData copies |
| RunOnce registry value named 'gsx' written pointing to a ProgramData executable (T1547.001) | Sysmon EID 13, Windows registry monitoring | Persistence | Low — value name 'gsx' in RunOnce is non-standard |
| Process calling SetWindowsHookEx for low-level keyboard hook and writing to ClipBoard.txt (T1056.001) | EDR API hook telemetry, Sysmon EID 11 | Collection | Medium — legitimate accessibility tools use keyboard hooks |
| Process reading browser SQLite logins tables and terminating browser processes before extraction (T1555.003) | EDR file access telemetry, process termination events | Credential Access | Medium — password managers may access credential stores |
Required Log Sources
- Sysmon Event ID 1 (Process Create)
- Sysmon Event ID 11 (File Create)
- Sysmon Event ID 13 (Registry Value Set)
- Sysmon Event ID 7 (Image Load)
- Windows Security Log 4688 (Process Creation)
- EDR process telemetry
Key Behavioral Indicators
- Firefox.exe spawned from Desktop with no corresponding Firefox installation context
- CreateProcessW launching C:\ProgramData\Firefox\Leon.exe from non-browser parent
- GetTempFileNameW followed by file write and 'Downloading File...' string in memory
- Browser process termination immediately followed by SQLite logins table access
- GetCurrentProcessId combined with cvtres.exe, csc.exe, vbc.exe name checks for sandbox evasion
Control Gaps
- Static signature-based AV may miss dynamic API resolution and XOR obfuscation
- Network DLP unlikely to detect encrypted exfiltration over HTTP C2 channel
- Host-based file scanning may miss hidden Leon.exe if hidden attributes bypass indexing
False Positive Assessment
Low — hidden ProgramData Firefox directory, RunOnce value 'gsx', and ClipBoard.txt keylog file are highly specific to BabylonRAT and unlikely in legitimate software
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict outbound HTTP connections from non-browser processes to unknown domains
- Deploy Sysmon with registry, file, and process creation logging on all endpoints
- Monitor for new files under C:\ProgramData\ with hidden attributes
User Protection
- Enforce application allow-listing to prevent execution of unexpected Firefox-branded PE files
- Ensure Firefox is only launched from its official installation directory
- Alert on browser credential stores accessed by non-browser processes
Security Awareness
- Warn users not to execute Firefox downloads from untrusted sources or direct links
- Train staff to verify file origin and digital signature before running browser-named executables
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping17 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Discovery
Tactic
Command and Control
Tactic
Exfiltration
Plain-Language Summary
A malicious program disguised as the Firefox browser secretly installs itself on Windows computers, hides its files, and reconnects each time the computer starts. It can record what you type, steal saved passwords from Chrome and Firefox, take screenshots, and let attackers remotely control the machine. It has been used against government institutions and political figures in Malaysia. Update your antivirus, do not run unfamiliar executables claiming to be Firefox, and check for the file Leon.exe in hidden ProgramData folders.
Additional IOCs
- Registry Keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\gsx- RunOnce entry pointing to Leon.exe for logon persistence
- File Paths:
C:\ProgramData\Firefox\Leon.exe- Hidden dropped payload path under fake Firefox directoryC:\ProgramData\Firefox\- Hidden directory created to masquerade as Firefox install%APPDATA%\Roaming\ConfigEx- Secondary directory created via thread for config storage
- Other:
sqlite3.dll- File path checked under %APPDATA%\Microsoft\Configs\ during file manager command
Showing defanged values
- domaingsx[.]uk[.]comPrimary C2 server domain contacted by BabylonRAT
- filenameClipBoard.txtKeystroke log file written by keyboard hook handler
- filenameLeon.exeDropped persistent payload copied to hidden Firefox directory
- file_path%APPDATA%\Roaming\ConfigExSecondary directory created via thread for config storage
- file_pathC:\ProgramData\Firefox\Hidden directory created to masquerade as Firefox install
- file_pathC:\ProgramData\Firefox\Leon.exeHidden dropped payload path under fake Firefox directory
- md572999c0da0454511b066547206ed7a58MD5 of Firefox-impersonating PE32 loader sample
- registry_keyHKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\gsxRunOnce entry pointing to Leon.exe for logon persistence
- sha2562f61950c3baa58573fac514205cead5afd6e27e84bb2b91b233a9f045d9b3f4cSHA256 of Firefox-impersonating PE32 loader sample
Stay currentSubscribe via RSS