babuk | d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd

General

Target

d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd
Size

172KB
Sample

210826-tcp94zce5e
MD5

a8d41cdb1096e641af72ae7dfa954433
SHA1

492971020433977d73baa18080c5615fc28f6e9a
SHA256

d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd
SHA512

875f98193a106c6f241f1eda58e720dd2351a7dae1abe5dd312bb9127866d0e11c4a9130177dfaf197750f4eace1367489eb50515b3bac6c944ae39609b875a8

Score

10^/10

Malware Config

Extracted

Path

C:\Documents and Settings\How To Restore Your Files.txt

Ransom Note

Hi, friend. Your files are encrypted. And you can't do anything with them. If you want to restore them, contact us via telegram @username312321 Price - 350 $ You can pay with BTC - bc1qd53hpk76zutapw8tsgnnkeuuuhuk4ecr2wrd93

Wallets

bc1qd53hpk76zutapw8tsgnnkeuuuhuk4ecr2wrd93

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Targets

- Target
  
  d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd
- Size
  
  172KB
- MD5
  
  a8d41cdb1096e641af72ae7dfa954433
- SHA1
  
  492971020433977d73baa18080c5615fc28f6e9a
- SHA256
  
  d30f4f3ab220d45783b08baec0e322ee10841beed00dc6ff00569ac5d02709fd
- SHA512
  
  875f98193a106c6f241f1eda58e720dd2351a7dae1abe5dd312bb9127866d0e11c4a9130177dfaf197750f4eace1367489eb50515b3bac6c944ae39609b875a8
Score

10^/10

babuk smokeloader backdoor discovery evasion ransomware spyware stealer themida trojan
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1