General
Target

391cfcd153881743556f76de7bbca5b19857f8b69a6f6f6dfde6fd9b06c17f5e

Size

75KB

Sample

210831-kk3zw312ws

Score
10/10
MD5

98b04a1cfdf18674315ec137733553a7

SHA1

dd1cdb8782b5e08695b006393d1e8ab4e447556e

SHA256

391cfcd153881743556f76de7bbca5b19857f8b69a6f6f6dfde6fd9b06c17f5e

SHA512

3c5d9884a922b4b974c3dbd0e6f73292b7bfa761a1e50cfb1af07752261cf1a8ea2520a13f28f7040d788bff3837c62c7a6595f03b1c1be5f8d4ea9848f09cb5

Malware Config

Extracted

Path

C:\Documents and Settings\How To Restore Your Files.txt

Ransom Note
############## [ babyk ransomware ] ############## * What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data without us. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. * What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. * What information compromised? ---------------------------------------------- We copied many data from your internal network, here are some proofs (private link): http://gtmx56k4hutn3ikv.onion/blog/ff6b763849c49971c7ef8508064a3d8681529c7f45e532ff9e3d9ec13165263b/ For additional confirmations, please chat with us/ In cases of ignoring us, the information will be released to the public in blog http://gtmx56k4hutn3ikv.onion/ * How to contact us? ---------------------------------------------- 1) Download for browser: https://www.torproject.org/download/ 2) Open it 3) Follow this link in tor browser: http://babukq4e2p4wu4iq.onion/login.php?id=l6Kr29xLbfnq1f0jzES55LLmmrZPd8
URLs

http://gtmx56k4hutn3ikv.onion/blog/ff6b763849c49971c7ef8508064a3d8681529c7f45e532ff9e3d9ec13165263b/

http://gtmx56k4hutn3ikv.onion/

http://babukq4e2p4wu4iq.onion/login.php?id=l6Kr29xLbfnq1f0jzES55LLmmrZPd8

Targets
Target

391cfcd153881743556f76de7bbca5b19857f8b69a6f6f6dfde6fd9b06c17f5e

MD5

98b04a1cfdf18674315ec137733553a7

Filesize

75KB

Score
10/10
SHA1

dd1cdb8782b5e08695b006393d1e8ab4e447556e

SHA256

391cfcd153881743556f76de7bbca5b19857f8b69a6f6f6dfde6fd9b06c17f5e

SHA512

3c5d9884a922b4b974c3dbd0e6f73292b7bfa761a1e50cfb1af07752261cf1a8ea2520a13f28f7040d788bff3837c62c7a6595f03b1c1be5f8d4ea9848f09cb5

Tags

Signatures

  • Babuk Locker

    Description

    RaaS first seen in 2021 initially called Vasa Locker.

    Tags

  • Deletes shadow copies

    Description

    Ransomware often targets backup files to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery
  • Modifies extensions of user files

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

  • Enumerates connected drives

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Tasks

                    static1

                    Score
                    N/A

                    behavioral1

                    Score
                    10/10

                    behavioral2

                    Score
                    10/10