Description
RaaS first seen in 2021 initially called Vasa Locker.
General
Target
Size
Sample
babuk
79KB
220204-qg5mrsacg7
Score
10/10
MD5
SHA1
SHA256
SHA512
92832ae49373b56748817cb5398ed706
61e4505d605882b809d9c7f3dcbf163ff1678382
1e24560100d010c27cc19c59f9fe1531e4286ecb21fe53763165f30c5f58dc90
398ef0e5ffb6f914a2d1df23f12561153ef52ea28d345232cbb2daa84c43d1f1934be0c40d00b2502c2437c2733d0cdf75d24be6a8b47fc69648ad16c0bb4858
Malware Config
Targets
Target
MD5
Filesize
babuk
92832ae49373b56748817cb5398ed706
79KB
Score
10/10
SHA1
SHA256
SHA512
61e4505d605882b809d9c7f3dcbf163ff1678382
1e24560100d010c27cc19c59f9fe1531e4286ecb21fe53763165f30c5f58dc90
398ef0e5ffb6f914a2d1df23f12561153ef52ea28d345232cbb2daa84c43d1f1934be0c40d00b2502c2437c2733d0cdf75d24be6a8b47fc69648ad16c0bb4858
Tags
Signatures
-
Babuk Locker
-
Deletes shadow copies
Description
Ransomware often targets backup files to inhibit system recovery.
Tags
TTPs
-
Modifies extensions of user files
Description
Ransomware generally changes the extension on encrypted files.
Tags
-
Sets service image path in registry
Tags
TTPs
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Enumerates connected drives
Description
Attempts to read the root path of hard drives other than the default C: drive.
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10
behavioral2
Score
10/10