Resubmissions

10-03-2021 22:41

210310-c4hgxpl6m6 10

10-03-2021 22:03

210310-atmrjjrp5x 10

22-02-2021 18:34

210222-mfkm1zpavj 10

General

  • Target

    391cfcd153881743556f76de7bbca5b19857f8b69a6f6f6dfde6fd9b06c17f5e

  • Size

    75KB

  • Sample

    210310-atmrjjrp5x

  • MD5

    98b04a1cfdf18674315ec137733553a7

  • SHA1

    dd1cdb8782b5e08695b006393d1e8ab4e447556e

  • SHA256

    391cfcd153881743556f76de7bbca5b19857f8b69a6f6f6dfde6fd9b06c17f5e

  • SHA512

    3c5d9884a922b4b974c3dbd0e6f73292b7bfa761a1e50cfb1af07752261cf1a8ea2520a13f28f7040d788bff3837c62c7a6595f03b1c1be5f8d4ea9848f09cb5

Score
10/10

Malware Config

Extracted

Path

C:\How To Restore Your Files.txt

Ransom Note
############## [ babyk ransomware ] ############## * What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data without us. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. * What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. * What information compromised? ---------------------------------------------- We copied many data from your internal network, here are some proofs (private link): http://gtmx56k4hutn3ikv.onion/blog/ff6b763849c49971c7ef8508064a3d8681529c7f45e532ff9e3d9ec13165263b/ For additional confirmations, please chat with us/ In cases of ignoring us, the information will be released to the public in blog http://gtmx56k4hutn3ikv.onion/ * How to contact us? ---------------------------------------------- 1) Download for browser: https://www.torproject.org/download/ 2) Open it 3) Follow this link in tor browser: http://babukq4e2p4wu4iq.onion/login.php?id=l6Kr29xLbfnq1f0jzES55LLmmrZPd8
URLs

http://gtmx56k4hutn3ikv.onion/blog/ff6b763849c49971c7ef8508064a3d8681529c7f45e532ff9e3d9ec13165263b/

http://gtmx56k4hutn3ikv.onion/

http://babukq4e2p4wu4iq.onion/login.php?id=l6Kr29xLbfnq1f0jzES55LLmmrZPd8

Targets

    • Target

      391cfcd153881743556f76de7bbca5b19857f8b69a6f6f6dfde6fd9b06c17f5e

    • Size

      75KB

    • MD5

      98b04a1cfdf18674315ec137733553a7

    • SHA1

      dd1cdb8782b5e08695b006393d1e8ab4e447556e

    • SHA256

      391cfcd153881743556f76de7bbca5b19857f8b69a6f6f6dfde6fd9b06c17f5e

    • SHA512

      3c5d9884a922b4b974c3dbd0e6f73292b7bfa761a1e50cfb1af07752261cf1a8ea2520a13f28f7040d788bff3837c62c7a6595f03b1c1be5f8d4ea9848f09cb5

    Score
    10/10
    • Babuk Locker

      RaaS first seen in 2021 initially called Vasa Locker.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks