General
-
Target
2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.zip
-
Size
29KB
-
Sample
250110-mejeza1qet
-
MD5
e3794ed40568fa89da19f0fd2975d195
-
SHA1
656ef4ba7e7a11985fef9012d5406d3d7306b933
-
SHA256
ffe25e376aa3e54a2752c4fa17fd2076481a58e96b788f1a1d6582aaf2e3789a
-
SHA512
373f812edde6c19689f1ff240de36056d3571c4a17793d178e4044d6a20169aaae5011d7e3b557b0c34064615ba019e2ba31173b1b990304b283af39d60efc82
-
SSDEEP
384:YnrpLEorl2SeH8K8lIAA7gXeVvfLpNH+CkcaivhL7xqIfPdih+GvUknVNV26unfQ:Yr6orl2TH3BF5+C2ChEFYoVNV/aj6xhT
Static task
static1
Behavioral task
behavioral1
Sample
2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\Recovery\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/104617a28c7b21518d506b079ca9d5221551f89d5d54025a1ec71dd33aacd896/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://vq3zf757tzpwhs7bulnr43d2rfg5fkvvfkhee2zhhzievuxrbnarmgqd.onion/4c43fb6f271eda10ac65ec0dc918f7ec851455acb98c1fe29f3b2feffe53c286
Targets
-
-
Target
2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe
-
Size
79KB
-
MD5
f6282c938e0662cf851feee0146d79a4
-
SHA1
9d0c6528565303e5b10a964a2783c77f25b9695b
-
SHA256
2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf
-
SHA512
b99be65ddc6154128992b510aa1b053b56dbad7f91f9102e42a06ada2f3c58f5ac6423483728648c20adce862c6f0e136913c6d0441a47391cedc76194c2936f
-
SSDEEP
1536:Iiyy6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:IiyshZ5YesrQLOJgY8Zp8LHD4XWaNH7Q
-
Babuk family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (228) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-