Overview

overview

10

Static

static

3d554fe3ed...le.exe

windows7_x64

10

3d554fe3ed...le.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d554fe3ed824df5bb625bcff4ddde834866164088358ddabc4e5aec8a6562b0.sample

  • Size

    79KB

  • Sample

    210726-sa18xqar2e

  • MD5

    012393fc32a1be21437634a2de7019f1

  • SHA1

    a5c223240be45c0e29a9c119b242ee0dc87968e9

  • SHA256

    3d554fe3ed824df5bb625bcff4ddde834866164088358ddabc4e5aec8a6562b0

  • SHA512

    58e8cb9e1420eddbd8b864021184ca892ead2f9e5e24877cacacac786cedfeb4cdfbcbdb73dc0c444949dfd50a4a1b2f9659f0cf2210099cfd99d36de8a1f801

Score
10/10
babukransomware

Malware Config

Targets

    • Target

      3d554fe3ed824df5bb625bcff4ddde834866164088358ddabc4e5aec8a6562b0.sample

    • Size

      79KB

    • MD5

      012393fc32a1be21437634a2de7019f1

    • SHA1

      a5c223240be45c0e29a9c119b242ee0dc87968e9

    • SHA256

      3d554fe3ed824df5bb625bcff4ddde834866164088358ddabc4e5aec8a6562b0

    • SHA512

      58e8cb9e1420eddbd8b864021184ca892ead2f9e5e24877cacacac786cedfeb4cdfbcbdb73dc0c444949dfd50a4a1b2f9659f0cf2210099cfd99d36de8a1f801

    Score
    10/10
    babukransomware

    • Babuk Locker

      RaaS first seen in 2021 initially called Vasa Locker.

      ransomwarebabuk

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks