babuk | bb845cf9c1674452a995f58b3971c04fd67a0a8d256288e58cb4454bb80a5efe | Triage

Sharing

General

Target

2024-11-03_2298d910b2d34e870e0f561eda4dcfc6_babuk_destroyer
Size

79KB
Sample

241103-y4y3hawlgq
MD5

2298d910b2d34e870e0f561eda4dcfc6
SHA1

078b2cace5161e34aaaaeba6bfbe3f6259651f34
SHA256

bb845cf9c1674452a995f58b3971c04fd67a0a8d256288e58cb4454bb80a5efe
SHA512

6465216a71c116321a6e7d9e1746247cfe1c29a5897422f13ed55cfb3a0daa42ba673a7cc308bf5440c6bf5fb084d065a6b4aab84c11ca1d81fdf23c09cbfe33
SSDEEP

1536:N8WkWBeG/vEbmsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nsf:lBeQsmsrQLOJgY8Zp8LHD4XWaNH71dLc

Score

10^/10

babuk defense_evasion discovery execution impact ransomware

Malware Config

Targets

- Target
  
  2024-11-03_2298d910b2d34e870e0f561eda4dcfc6_babuk_destroyer
- Size
  
  79KB
- MD5
  
  2298d910b2d34e870e0f561eda4dcfc6
- SHA1
  
  078b2cace5161e34aaaaeba6bfbe3f6259651f34
- SHA256
  
  bb845cf9c1674452a995f58b3971c04fd67a0a8d256288e58cb4454bb80a5efe
- SHA512
  
  6465216a71c116321a6e7d9e1746247cfe1c29a5897422f13ed55cfb3a0daa42ba673a7cc308bf5440c6bf5fb084d065a6b4aab84c11ca1d81fdf23c09cbfe33
- SSDEEP
  
  1536:N8WkWBeG/vEbmsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nsf:lBeQsmsrQLOJgY8Zp8LHD4XWaNH71dLc
Score

10^/10

babuk defense_evasion discovery execution impact ransomware
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Babuk family
  babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (173) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

babukdefense_evasiondiscoveryexecutionimpactransomware

behavioral2

babukdefense_evasiondiscoveryexecutionimpactransomware