babuk | a8afd616cbe42da1ec57320658b9289cce7884d41c65909e1cda3b9422d9c126 | Triage

Sharing

General

Target

2024-11-12_fcf9da264da3bcb23f331b0c51568a66_babuk_destroyer
Size

79KB
Sample

241112-md7q6szhql
MD5

fcf9da264da3bcb23f331b0c51568a66
SHA1

6c59af9ef590d086209461239185a0ebca51f0a4
SHA256

a8afd616cbe42da1ec57320658b9289cce7884d41c65909e1cda3b9422d9c126
SHA512

b8a230d034501bf5d569e869f574ac34538db6419366a1827d7c06c4b813fadada3c3fa814853dec8fce7ee0c521a47ff127a1b5abd43316673f7df6bb521b8a
SSDEEP

1536:A2nhxMlpCK2979srQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG23i3:Rhx+I79srQLOJgY8Zp8LHD4XWaNH71d+

Score

10^/10

babuk defense_evasion discovery execution impact ransomware

Malware Config

Targets

- Target
  
  2024-11-12_fcf9da264da3bcb23f331b0c51568a66_babuk_destroyer
- Size
  
  79KB
- MD5
  
  fcf9da264da3bcb23f331b0c51568a66
- SHA1
  
  6c59af9ef590d086209461239185a0ebca51f0a4
- SHA256
  
  a8afd616cbe42da1ec57320658b9289cce7884d41c65909e1cda3b9422d9c126
- SHA512
  
  b8a230d034501bf5d569e869f574ac34538db6419366a1827d7c06c4b813fadada3c3fa814853dec8fce7ee0c521a47ff127a1b5abd43316673f7df6bb521b8a
- SSDEEP
  
  1536:A2nhxMlpCK2979srQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG23i3:Rhx+I79srQLOJgY8Zp8LHD4XWaNH71d+
Score

10^/10

babuk defense_evasion discovery execution impact ransomware
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Babuk family
  babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (232) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

babukdefense_evasiondiscoveryexecutionimpactransomware

behavioral2

babukdefense_evasiondiscoveryexecutionimpactransomware