General

  • Target

    ab4eae618bb05b4fb4a8d3790a0d18a3e1566ab477519991cb161398803a8847.sample

  • Size

    75KB

  • Sample

    210726-bb3tq54q7e

  • MD5

    03f524377f461bfa70859fb5805b5a03

  • SHA1

    e8ead4332cded71755e478922d09d01975f9119f

  • SHA256

    ab4eae618bb05b4fb4a8d3790a0d18a3e1566ab477519991cb161398803a8847

  • SHA512

    ed45d0605829c76e05895e1f4aa72c6f15d20a2cea97533323cffe1b89e640bc703314a4c3d510dec8a7c183c78c30c9c9d2a2a1fe064018c5017eb6cc990da0

Score
10/10

Malware Config

Extracted

Path

C:\How To Restore Your Files.txt

Ransom Note
############## [ babyk ransomware ] ############## * What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data without us. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. * What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. * How to contact us? ---------------------------------------------- 1) Download for browser: https://www.torproject.org/download/ 2) Open it 3) Follow this link in tor browser: http://babukq4e2p4wu4iq.onion/login.php?id=qrkurJuYkvPsMF4sX5avnaBrUHldGe
URLs

http://babukq4e2p4wu4iq.onion/login.php?id=qrkurJuYkvPsMF4sX5avnaBrUHldGe

Targets

    • Target

      ab4eae618bb05b4fb4a8d3790a0d18a3e1566ab477519991cb161398803a8847.sample

    • Size

      75KB

    • MD5

      03f524377f461bfa70859fb5805b5a03

    • SHA1

      e8ead4332cded71755e478922d09d01975f9119f

    • SHA256

      ab4eae618bb05b4fb4a8d3790a0d18a3e1566ab477519991cb161398803a8847

    • SHA512

      ed45d0605829c76e05895e1f4aa72c6f15d20a2cea97533323cffe1b89e640bc703314a4c3d510dec8a7c183c78c30c9c9d2a2a1fe064018c5017eb6cc990da0

    Score
    10/10
    • Babuk Locker

      RaaS first seen in 2021 initially called Vasa Locker.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks