Extracted

• • Target

    002.7z

  • Size

    11.2MB

  • MD5

    82180da2d9ecde4947a618ff1a37fdad

  • SHA1

    ae327ea9229498e86afb337b87cf6d6f4caaa309

  • SHA256

    cc65535243dfd3cd54a9c5ecfcb93c7f918a87c725e9c52925017ab92effe278

  • SHA512

    606ddfb833eb38952403ae10e9eec694d45e3fb2df326d5825f93257d605552868343e80fd6e3a497d690dabe8ed1493b60843118f1aa5412be8cc55a66335a3

  • SSDEEP

    196608:nYcNyJpHBLBc6gKWYZzbK26sqaddXpgPxydfcNQChzHayMxpJ51LipiFe5TZD0B:n5yJ1pB+KWYtbK26sq25GyxcR6yMt51L

  Score

  1^/10
  behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9

• • Target

    01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe

  • Size

    155KB

  • MD5

    7e3b2b10d66955465c12da9f2ab43e36

  • SHA1

    2ee3d7ce4ec3461026e910fdfcf9d18dd43eb380

  • SHA256

    01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550

  • SHA512

    ce37aff2e2aba9d6434454e17bafeebc47e9d86a716fcd9732bc03bf6484c4b6428d43322279b9273c3e5386ce924853d3aebf90178b2fa5009d63e1defd47a0

  • SSDEEP

    3072:l5K/B0toLuSNJilZHQsozTS+SMqqDL2/TrKLOG:lcytw7a1yTS+xqqDL6HKL

  Score

  3^/10

  discovery
  behavioral10behavioral11behavioral12behavioral13behavioral14behavioral15behavioral16behavioral17behavioral18

• • Target

    01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe

  • Size

    79KB

  • MD5

    f9afb31bc17811e5ab4fa406f105b1fe

  • SHA1

    d1a9449dcc8a3aa0c887bce71f128866175f679a

  • SHA256

    01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f

  • SHA512

    6feca3dfa221b704208754e67bcdce02a2253961da098b3e376d11217cd00b9f77e42f37f242e1a1f4b759b5fd172c29c9f153fce32eace48e07e802aff40b55

  • SSDEEP

    1536:SX6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:uhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI

  Score

  10^/10

  discoverybabukdarksidedefense_evasionexecutionimpactransomware

  • Babuk Locker

    RaaS first seen in 2021 initially called Vasa Locker.

    ransomwarebabuk

  • Babuk family

    babuk

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Darkside family

    darkside

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (190) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral19behavioral20behavioral21behavioral22behavioral23behavioral24behavioral25behavioral26behavioral27

• • Target

    02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe

  • Size

    70KB

  • MD5

    58d6eab3aafd9139a2f1c7606ecd4cef

  • SHA1

    4152a7431b3d5dd8b0f6ad08148cb166315f41e9

  • SHA256

    02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6

  • SHA512

    ae92012d8401c886cb898ac0134db1567aaefb467d04d7afdb4e3e6b390b929dc353467d55b8cce5f3c74c942ac79ce565c172e296468ac44b3d8bd730a52c49

  • SSDEEP

    1536:ZZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:wd5BJHMqqDL2/Ovvdr

  Score

  6^/10

  discoverypersistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral28behavioral29behavioral30behavioral31behavioral32