babuk | 823556fe1365ab76688a314f022cc047fce8151aa2d4c5f95f812d1a0b6bcb0f | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

2025-03-07...er.exe

windows7-x64

2025-03-07...er.exe

windows10-2004-x64

Sharing

General

Target

2025-03-07_f6dde2c7e411175dd366be97520d2204_babuk_destroyer
Size

79KB
Sample

250307-wdlndavly2
MD5

f6dde2c7e411175dd366be97520d2204
SHA1

11ab0765f0b887895e64afc63876ca70f3f24e86
SHA256

823556fe1365ab76688a314f022cc047fce8151aa2d4c5f95f812d1a0b6bcb0f
SHA512

464ba8102430f14c4b6e49eaf5f0861f22fd251e5b96fc88bbfb42aa4ef4516389fbb855528a003e50e149fef0ef0d9d2438fc397703e30450938b401a7a567b
SSDEEP

1536:7KkWBeGPGEbmsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nsf:CBeBsmsrQLOJgY8Zp8LHD4XWaNH71dLc

Score

10^/10

babuk defense_evasion discovery execution impact ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2025-03-07_f6dde2c7e411175dd366be97520d2204_babuk_destroyer.exe

Resource

win7-20240903-en

babuk defense_evasion discovery execution impact ransomware

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

2025-03-07_f6dde2c7e411175dd366be97520d2204_babuk_destroyer.exe

Resource

win10v2004-20250217-en

babuk defense_evasion discovery execution impact ransomware

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  2025-03-07_f6dde2c7e411175dd366be97520d2204_babuk_destroyer
- Size
  
  79KB
- MD5
  
  f6dde2c7e411175dd366be97520d2204
- SHA1
  
  11ab0765f0b887895e64afc63876ca70f3f24e86
- SHA256
  
  823556fe1365ab76688a314f022cc047fce8151aa2d4c5f95f812d1a0b6bcb0f
- SHA512
  
  464ba8102430f14c4b6e49eaf5f0861f22fd251e5b96fc88bbfb42aa4ef4516389fbb855528a003e50e149fef0ef0d9d2438fc397703e30450938b401a7a567b
- SSDEEP
  
  1536:7KkWBeGPGEbmsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2nsf:CBeBsmsrQLOJgY8Zp8LHD4XWaNH71dLc
Score

10^/10

babuk defense_evasion discovery execution impact ransomware
- Babuk Locker
  RaaS first seen in 2021 initially called Vasa Locker.
  ransomware babuk
- Babuk family
  babuk
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (181) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

babukdefense_evasiondiscoveryexecutionimpactransomware

behavioral2

babukdefense_evasiondiscoveryexecutionimpactransomware

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.