babuk | ca357f7a68a547cbc6a7728d93a9eeca6892944b85554ff625390b5609d127df | Triage

Submit
Reports

Overview

overview

Static

static

ca357f7a68...df.exe

windows7-x64

ca357f7a68...df.exe

windows10-2004-x64

Sharing

General

Target

ca357f7a68a547cbc6a7728d93a9eeca6892944b85554ff625390b5609d127df
Size

79KB
Sample

221228-w81qsaec3s
MD5

632346fc6c6d13b004b01b450acbdb14
SHA1

34813d5c989d456777158ea98ee8b68eaf6c7117
SHA256

ca357f7a68a547cbc6a7728d93a9eeca6892944b85554ff625390b5609d127df
SHA512

250eaffcadb6f66dcad974657a2cc2f7c8f0e306fb58a16c9bb8b0c79347d984dee7881e01fd2139512d760f2decd5acf32817ec5f62decf44f660e6431e5599
SSDEEP

1536:V6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:BhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI

Score

10^/10

babuk ransomware

Static task

static1

Behavioral task

behavioral1

Sample

ca357f7a68a547cbc6a7728d93a9eeca6892944b85554ff625390b5609d127df.exe

Resource

win7-20220812-en

babuk ransomware

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

ca357f7a68a547cbc6a7728d93a9eeca6892944b85554ff625390b5609d127df.exe

Resource

win10v2004-20220812-en

babuk ransomware

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  ca357f7a68a547cbc6a7728d93a9eeca6892944b85554ff625390b5609d127df
- Size
  
  79KB
- MD5
  
  632346fc6c6d13b004b01b450acbdb14
- SHA1
  
  34813d5c989d456777158ea98ee8b68eaf6c7117
- SHA256
  
  ca357f7a68a547cbc6a7728d93a9eeca6892944b85554ff625390b5609d127df
- SHA512
  
  250eaffcadb6f66dcad974657a2cc2f7c8f0e306fb58a16c9bb8b0c79347d984dee7881e01fd2139512d760f2decd5acf32817ec5f62decf44f660e6431e5599
- SSDEEP
  
  1536:V6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:BhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
Score

10^/10

babuk ransomware
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

babukransomware

behavioral2

babukransomware

© 2018-2024

Terms | Privacy