babuk | ab4eae618bb05b4fb4a8d3790a0d18a3e1566ab477519991cb161398803a8847

General

Target

ab4eae618bb05b4fb4a8d3790a0d18a3e1566ab477519991cb161398803a8847.sample
Size

75KB
Sample

210726-bb3tq54q7e
MD5

03f524377f461bfa70859fb5805b5a03
SHA1

e8ead4332cded71755e478922d09d01975f9119f
SHA256

ab4eae618bb05b4fb4a8d3790a0d18a3e1566ab477519991cb161398803a8847
SHA512

ed45d0605829c76e05895e1f4aa72c6f15d20a2cea97533323cffe1b89e640bc703314a4c3d510dec8a7c183c78c30c9c9d2a2a1fe064018c5017eb6cc990da0

Score

10^/10

babuk ransomware

Malware Config

Extracted

Path

C:\How To Restore Your Files.txt

Ransom Note

############## [ babyk ransomware ] ############## * What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data without us. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. * What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. * How to contact us? ---------------------------------------------- 1) Download for browser: https://www.torproject.org/download/ 2) Open it 3) Follow this link in tor browser: http://babukq4e2p4wu4iq.onion/login.php?id=qrkurJuYkvPsMF4sX5avnaBrUHldGe

URLs

http://babukq4e2p4wu4iq.onion/login.php?id=qrkurJuYkvPsMF4sX5avnaBrUHldGe

Targets

- Target
  
  ab4eae618bb05b4fb4a8d3790a0d18a3e1566ab477519991cb161398803a8847.sample
- Size
  
  75KB
- MD5
  
  03f524377f461bfa70859fb5805b5a03
- SHA1
  
  e8ead4332cded71755e478922d09d01975f9119f
- SHA256
  
  ab4eae618bb05b4fb4a8d3790a0d18a3e1566ab477519991cb161398803a8847
- SHA512
  
  ed45d0605829c76e05895e1f4aa72c6f15d20a2cea97533323cffe1b89e640bc703314a4c3d510dec8a7c183c78c30c9c9d2a2a1fe064018c5017eb6cc990da0
Score

10^/10

babuk ransomware
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2