General
Target

a499f810c2e52fe9f8adcd5817b2d985

Size

79KB

Sample

211107-mgjhrafcdj

Score
10/10
MD5

a499f810c2e52fe9f8adcd5817b2d985

SHA1

b23523cc4d6092a90aeb4522b21f94c335864090

SHA256

245e191bfe998ad9ef2d6b169af22f3c290e9950234f8ddd0f4a03cb3eebf761

SHA512

16d277a56c8b864b0c22b28305ba442b33ca2e5e0be32d193a19887c4c9193c9e192e9e1638af4e40600508cc38c7004e3a18007f281ad1577e0c6a428a5ea5b

Malware Config
Targets
Target

a499f810c2e52fe9f8adcd5817b2d985

MD5

a499f810c2e52fe9f8adcd5817b2d985

Filesize

79KB

Score
10/10
SHA1

b23523cc4d6092a90aeb4522b21f94c335864090

SHA256

245e191bfe998ad9ef2d6b169af22f3c290e9950234f8ddd0f4a03cb3eebf761

SHA512

16d277a56c8b864b0c22b28305ba442b33ca2e5e0be32d193a19887c4c9193c9e192e9e1638af4e40600508cc38c7004e3a18007f281ad1577e0c6a428a5ea5b

Tags

Signatures

  • Babuk Locker

    Description

    RaaS first seen in 2021 initially called Vasa Locker.

    Tags

  • Deletes shadow copies

    Description

    Ransomware often targets backup files to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery
  • Modifies extensions of user files

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

  • Enumerates connected drives

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Tasks

                    static1

                    Score
                    N/A

                    behavioral1

                    Score
                    10/10

                    behavioral2

                    Score
                    10/10