General
-
Target
2024-02-16_239379865eecbe894b9dfa3623a11878_babuk_destroyer
-
Size
79KB
-
Sample
240216-d26dksfh91
-
MD5
239379865eecbe894b9dfa3623a11878
-
SHA1
bb834c9401ea34b8423530b84094a558e824a650
-
SHA256
65813aa45df5c32fbeafd976881ad119d1b9e3b7dfe4e632e236b2a4dcac9c47
-
SHA512
42b560f3391202c4dfc440d82805d452d71f3a5746bd58ffef01f15dc0fc7bd5637e564929de0baf4d867633b44b25944bc711ec49e987f4002125d6cc6732ed
-
SSDEEP
1536:k6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:2hZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-16_239379865eecbe894b9dfa3623a11878_babuk_destroyer.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-16_239379865eecbe894b9dfa3623a11878_babuk_destroyer.exe
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
2024-02-16_239379865eecbe894b9dfa3623a11878_babuk_destroyer
-
Size
79KB
-
MD5
239379865eecbe894b9dfa3623a11878
-
SHA1
bb834c9401ea34b8423530b84094a558e824a650
-
SHA256
65813aa45df5c32fbeafd976881ad119d1b9e3b7dfe4e632e236b2a4dcac9c47
-
SHA512
42b560f3391202c4dfc440d82805d452d71f3a5746bd58ffef01f15dc0fc7bd5637e564929de0baf4d867633b44b25944bc711ec49e987f4002125d6cc6732ed
-
SSDEEP
1536:k6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:2hZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
Score10/10-
Renames multiple (188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-