Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2024-03-14_13616e15e6e161bf2c187d4ccff0a74a_babuk_destroyer
-
Size
80KB
-
Sample
240314-ke728afa2x
-
MD5
13616e15e6e161bf2c187d4ccff0a74a
-
SHA1
5dc358621f84c54e25a5127e6c75873b302878c0
-
SHA256
c16db5977b4fc0999e81d73641a520b05384431102acc29a3976b47bbad97751
-
SHA512
e65ec8a0258f0046801e84785355c379aaf375b05bf0759bb49d8a89fc289a1ff446d978842f03de96aa76eb07484c92bcf9e7118665f2c2ffc60384c078e41e
-
SSDEEP
1536:nc2hl9N/IolKfGsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG24m:nc2N/4usrQLOJgY8Zp8LHD4XWaNH71dc
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-14_13616e15e6e161bf2c187d4ccff0a74a_babuk_destroyer.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-14_13616e15e6e161bf2c187d4ccff0a74a_babuk_destroyer.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Users\readme_for_unlock.txt
https://gdpr-info.eu/
http://s4xpejatghnopeieoqvjqsnfl576jekizgmw52s7ydth6wgyi2wh2gid.onion
Targets
-
-
Target
2024-03-14_13616e15e6e161bf2c187d4ccff0a74a_babuk_destroyer
-
Size
80KB
-
MD5
13616e15e6e161bf2c187d4ccff0a74a
-
SHA1
5dc358621f84c54e25a5127e6c75873b302878c0
-
SHA256
c16db5977b4fc0999e81d73641a520b05384431102acc29a3976b47bbad97751
-
SHA512
e65ec8a0258f0046801e84785355c379aaf375b05bf0759bb49d8a89fc289a1ff446d978842f03de96aa76eb07484c92bcf9e7118665f2c2ffc60384c078e41e
-
SSDEEP
1536:nc2hl9N/IolKfGsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG24m:nc2N/4usrQLOJgY8Zp8LHD4XWaNH71dc
Score10/10-
Renames multiple (403) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-