e982e23b9195dcde4e06a12af2096cf9b08d5223873f49474e00e1fabdf818fa

General

Target

Local Virus Copies 1.zip
Size

2.9MB
Sample

210114-2gk6rjrd4e
MD5

1e68c999bdad5322793e45f635bc360e
SHA1

3355a8d394a1005950952ccff335597c60219304
SHA256

e982e23b9195dcde4e06a12af2096cf9b08d5223873f49474e00e1fabdf818fa
SHA512

3f98ae6a5066c79867703aca6185c48175c53b40848823902552b6f227fd94e2fc4a69eb3e9f8d2c9f05c9b5bfca0c85c8630b221c335532cac722cec2530a57

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\MSOCache\How To Restore Your Files.txt

Ransom Note

----------- [ Hello! ] -------------> ****BY BABUK LOCKER**** What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to contact us? ---------------------------------------------- Using TOR Browser ( https://www.torproject.org/download/ ): http://babukq4e2p4wu4iq.onion/login.php?id=8M60J4vCbbkKgM6QnA07E9qpkn0Qk7 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!

URLs

http://babukq4e2p4wu4iq.onion/login.php?id=8M60J4vCbbkKgM6QnA07E9qpkn0Qk7

Targets

- Target
  
  8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9
- Size
  
  30KB
- MD5
  
  e10713a4a5f635767dcd54d609bed977
- SHA1
  
  320d799beef673a98481757b2ff7e3463ce67916
- SHA256
  
  8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9
- SHA512
  
  fed1cb7e1798ea0d131a0d4962a2b9f6c700ee3e1c9482c7837be930ce5167196ac7b1e715d9c9a5c171c349f3df3dde1a42db8e439459bc742928f9d19b38a7
Score

10^/10

ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  
  8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9
- Size
  
  3.6MB
- MD5
  
  44a7085f729b68073b5c67bbc66829cc
- SHA1
  
  3c03a1c61932bec2b276600ea52bd2803285ec62
- SHA256
  
  8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9
- SHA512
  
  ab3e0d0fca5cc2ac38c282c2f69663291ff54367061ba15250e9b92f706f245fb353506838304c729da685421c2919e859df2d3aca5d793530d36a8ca0907f04
Score

3^/10
behavioral3 behavioral4