General
-
Target
2024-05-25_7bb7c2899106b7c16b787c98c37ac8df_babuk_destroyer
-
Size
80KB
-
Sample
240525-1brttsba6t
-
MD5
7bb7c2899106b7c16b787c98c37ac8df
-
SHA1
15ba68d29d846a9ea07ff0df4d84655cfce0a7a0
-
SHA256
63e2ba3f181ba59f1926b7588d9c8d3d5589c15eb4354bc23348f22a49d04f9d
-
SHA512
372dd659779b377a715c7f1b7dbffe76de3645289c6237550dbd07488b93ebbb287ff9e5d4ae4b28256db2418362652e7f5804d8d9b8850ca0c5dd4750dae28d
-
SSDEEP
1536:mV9N/IUx1fSsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG24m:UN/D6srQLOJgY8Zp8LHD4XWaNH71dLdy
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_7bb7c2899106b7c16b787c98c37ac8df_babuk_destroyer.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-25_7bb7c2899106b7c16b787c98c37ac8df_babuk_destroyer.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
C:\PerfLogs\Admin\readme_for_unlock.txt
https://gdpr-info.eu/
http://rytsr4wlztsd436yx36atz2h52kql7cnlksuvgvphrzxnl7abn3cccid.onion
Targets
-
-
Target
2024-05-25_7bb7c2899106b7c16b787c98c37ac8df_babuk_destroyer
-
Size
80KB
-
MD5
7bb7c2899106b7c16b787c98c37ac8df
-
SHA1
15ba68d29d846a9ea07ff0df4d84655cfce0a7a0
-
SHA256
63e2ba3f181ba59f1926b7588d9c8d3d5589c15eb4354bc23348f22a49d04f9d
-
SHA512
372dd659779b377a715c7f1b7dbffe76de3645289c6237550dbd07488b93ebbb287ff9e5d4ae4b28256db2418362652e7f5804d8d9b8850ca0c5dd4750dae28d
-
SSDEEP
1536:mV9N/IUx1fSsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG24m:UN/D6srQLOJgY8Zp8LHD4XWaNH71dLdy
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (439) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-