General
-
Target
babuk_v4.exe
-
Size
30KB
-
Sample
210125-bk7nj8slxx
-
MD5
9478050023c7f8668df4fc39b0ddd79c
-
SHA1
7925725cfb04d796f497e5142cba62860fbf87a9
-
SHA256
3dda3ee9164d6815a18a2c23651a53c35d52e3a5ad375001ec824cf532c202e6
-
SHA512
74bbf45112de1bf0d51ab0295118035a7e2c2028dd9b03bb8e222b9ccf6e077014c6b5d211b9d3ebe6434a41d883bcae14a0a3e969550ef094b30b73a38514e9
Static task
static1
Behavioral task
behavioral1
Sample
babuk_v4.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
babuk_v4.exe
Resource
win10v20201028
Malware Config
Extracted
C:\MSOCache\How To Restore Your Files.txt
http://gtmx56k4hutn3ikv.onion/?h2giV0RRxo38Z2pWhBTs
http://gtmx56k4hutn3ikv.onion/
http://babukq4e2p4wu4iq.onion/login.php?id=MNn0Flxa2JVxrT2gAiMfYdmAzyvUGi
Targets
-
-
Target
babuk_v4.exe
-
Size
30KB
-
MD5
9478050023c7f8668df4fc39b0ddd79c
-
SHA1
7925725cfb04d796f497e5142cba62860fbf87a9
-
SHA256
3dda3ee9164d6815a18a2c23651a53c35d52e3a5ad375001ec824cf532c202e6
-
SHA512
74bbf45112de1bf0d51ab0295118035a7e2c2028dd9b03bb8e222b9ccf6e077014c6b5d211b9d3ebe6434a41d883bcae14a0a3e969550ef094b30b73a38514e9
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-