babuk | 21611a8c76169a345715cf0d6dbf9e495e71ad235ed11bca5ee38ec281f75fc2

General

Target

21611a8c76169a345715cf0d6dbf9e495e71ad235ed11bca5ee38ec281f75fc2
Size

241KB
Sample

240529-k5z5ashf8z
MD5

5bb957a511d230c271fae129f48f1fdf
SHA1

a72f01cf027c7e385bbfc2488c91db14dadc9fac
SHA256

21611a8c76169a345715cf0d6dbf9e495e71ad235ed11bca5ee38ec281f75fc2
SHA512

5f815534114d0099cd28a5f732d0c6fca59ce535e1b55a42b99d22ca9ebcc921d9430bed9a36e723035326716d8b6f8872f748ed075305a1d4b1933eec92ee23
SSDEEP

6144:fyGt4iW5Mpj4tZx80FYuiHAZ2CLR+D7XnrlAPgT7:f94o4XRFYsZbt+D7nhj

Score

10^/10

Malware Config

Extracted

Path

C:\Recovery\How To Restore Your Files.txt

Ransom Note

----------- [ Hello, Schauer Agrotronic ] -------------> ****BY BABUK LOCKER**** What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. What information compromised? ---------------------------------------------- We copied more than 50 gb from your internal network, here are some proofs, for additional confirmations, please chat with us In cases of ignoring us, the information will be released to the public. How to contact us? ---------------------------------------------- Using TOR Browser ( https://www.torproject.org/download/ ): http://babukq4e2p4wu4iq.onion/login.php?id=p9gFgBg5TsdcO3mV9mf2RJlJoI0iy1 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!

URLs

http://babukq4e2p4wu4iq.onion/login.php?id=p9gFgBg5TsdcO3mV9mf2RJlJoI0iy1

Targets

- Target
  
  21611a8c76169a345715cf0d6dbf9e495e71ad235ed11bca5ee38ec281f75fc2
- Size
  
  241KB
- MD5
  
  5bb957a511d230c271fae129f48f1fdf
- SHA1
  
  a72f01cf027c7e385bbfc2488c91db14dadc9fac
- SHA256
  
  21611a8c76169a345715cf0d6dbf9e495e71ad235ed11bca5ee38ec281f75fc2
- SHA512
  
  5f815534114d0099cd28a5f732d0c6fca59ce535e1b55a42b99d22ca9ebcc921d9430bed9a36e723035326716d8b6f8872f748ed075305a1d4b1933eec92ee23
- SSDEEP
  
  6144:fyGt4iW5Mpj4tZx80FYuiHAZ2CLR+D7XnrlAPgT7:f94o4XRFYsZbt+D7nhj
Score

10^/10

babuk defense_evasion execution impact ransomware spyware stealer
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (441) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2