babuk | 9ba829497c489b88591ef040d5f4228e5edda50f031d654a82ea04dfae6fcfbc | Triage

Submit
Reports

Overview

overview

Static

static

9ba829497c...bc.exe

windows7-x64

9ba829497c...bc.exe

windows10-2004-x64

Sharing

General

Target

9ba829497c489b88591ef040d5f4228e5edda50f031d654a82ea04dfae6fcfbc
Size

79KB
Sample

221017-3nzrbadhcp
MD5

c05b05aff8880d94c757181cbbdd77cf
SHA1

84440af2b8f3db1303446b1067c0ed4d0295a4c4
SHA256

9ba829497c489b88591ef040d5f4228e5edda50f031d654a82ea04dfae6fcfbc
SHA512

504ff3c5756fc72ea085960768b509ddf8fd7bb2395270c36d58e85c7fc04abfadd74268eb84a81e892c5a90b3cf7bc6460f5f766507f1e12da64386cd4a4e39
SSDEEP

1536:m6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:ghZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI

Score

10^/10

babuk ransomware

Static task

static1

Behavioral task

behavioral1

Sample

9ba829497c489b88591ef040d5f4228e5edda50f031d654a82ea04dfae6fcfbc.exe

Resource

win7-20220812-en

babuk ransomware

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

9ba829497c489b88591ef040d5f4228e5edda50f031d654a82ea04dfae6fcfbc.exe

Resource

win10v2004-20220812-en

babuk ransomware

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  9ba829497c489b88591ef040d5f4228e5edda50f031d654a82ea04dfae6fcfbc
- Size
  
  79KB
- MD5
  
  c05b05aff8880d94c757181cbbdd77cf
- SHA1
  
  84440af2b8f3db1303446b1067c0ed4d0295a4c4
- SHA256
  
  9ba829497c489b88591ef040d5f4228e5edda50f031d654a82ea04dfae6fcfbc
- SHA512
  
  504ff3c5756fc72ea085960768b509ddf8fd7bb2395270c36d58e85c7fc04abfadd74268eb84a81e892c5a90b3cf7bc6460f5f766507f1e12da64386cd4a4e39
- SSDEEP
  
  1536:m6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:ghZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
Score

10^/10

babuk ransomware
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

babukransomware

behavioral2

babukransomware

© 2018-2024

Terms | Privacy