babuk | 2ae5895f6a5f1fe6ee1d5b060b600de7d11655c69c27ad3fbcd348759b7160c9

General

Target

2ae5895f6a5f1fe6ee1d5b060b600de7d11655c69c27ad3fbcd348759b7160c9.sample
Size

79KB
Sample

210726-9v5rvmlyce
MD5

d0cf60b2779a45bc9160e3bffcdf82d6
SHA1

5f4f54f118ed571e91012ab61e9dbcee40515338
SHA256

2ae5895f6a5f1fe6ee1d5b060b600de7d11655c69c27ad3fbcd348759b7160c9
SHA512

879b805d8eb16777c2db7607c6fa4d34e5853aeabf870420b774027ab78e0ec6f6b63c705e0d84c992ac4ee7d2904f0f4c2eab92a00ed4f261eb8d8662539629

Score

10^/10

babuk ransomware

Malware Config

Extracted

Path

C:\How To Restore Your Files.txt

Ransom Note

--------------- Hello --------------- *** By BABUCK LOCKER *** Your computers and servers are encrypted, and backups are deleted. We use strong encryption algorithms, so no one has yet been able to decrypt their files without our participation. The only way to decrypt your files is to purchase a universal decoder from us, which will restore all the encrypted data and your network. Follow our instructions below, and you will recover all your data: 1) Pay 0,006 bitcoin to 1E6cvG6iEbufvYspsDa3XQ3WJgEMvRTm9i 2) Send us message with transaction id to babuckransom@tutanota.com 3) Launch decryptor.exe, which our support will send you through email What guarantees? ----------------------------------------------------- We value our reputation. If we will not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is tested by time and will decrypt all your data. ----------------------------------------------------- !!! DO NOT TRY TO RECOVER ANY FILES YOURSELF. WE WILL NOT BE ABLE TO RESTORE THEM!!!

Emails

babuckransom@tutanota.com

Wallets

1E6cvG6iEbufvYspsDa3XQ3WJgEMvRTm9i

Targets

- Target
  
  2ae5895f6a5f1fe6ee1d5b060b600de7d11655c69c27ad3fbcd348759b7160c9.sample
- Size
  
  79KB
- MD5
  
  d0cf60b2779a45bc9160e3bffcdf82d6
- SHA1
  
  5f4f54f118ed571e91012ab61e9dbcee40515338
- SHA256
  
  2ae5895f6a5f1fe6ee1d5b060b600de7d11655c69c27ad3fbcd348759b7160c9
- SHA512
  
  879b805d8eb16777c2db7607c6fa4d34e5853aeabf870420b774027ab78e0ec6f6b63c705e0d84c992ac4ee7d2904f0f4c2eab92a00ed4f261eb8d8662539629
Score

10^/10

babuk ransomware
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2