General
-
Target
Trojan-Ransom.Win32.Babuk.a-2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.7z
-
Size
22KB
-
Sample
250327-snpw1awmt8
-
MD5
05736fead4f81b48adbb459dbc727d33
-
SHA1
ffcdcc5113cc6c2199d8522c0b8349bb847d2c5d
-
SHA256
22fee0b9c0435d8bea8ee63255ab4df89e167d10fad4e06909d5aa0a20c06d3f
-
SHA512
0e7046c299172e7d01d855fbe2e495992ee8be45a39e047a1128bf3250231a069770819ac0072f4d5bab96dd9d4532b42121f323ec16c1e50b58f07c1281adcb
-
SSDEEP
384:fu8K6uR9GJQkG12MRuj1qxMwys1iL7+kQer2l8JdhQg6LRpHx+4ZGYDvQVNzF:m8KjyQkGEWjawGL7z3hQtLBZIVN5
Static task
static1
Behavioral task
behavioral1
Sample
Trojan-Ransom.Win32.Babuk.a-2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.7z
Resource
win10v2004-20250314-en
Malware Config
Extracted
C:\4fc20efa2b2ad5aa4b35f8fcca90f7df\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/104617a28c7b21518d506b079ca9d5221551f89d5d54025a1ec71dd33aacd896/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://vq3zf757tzpwhs7bulnr43d2rfg5fkvvfkhee2zhhzievuxrbnarmgqd.onion/4c43fb6f271eda10ac65ec0dc918f7ec851455acb98c1fe29f3b2feffe53c286
Targets
-
-
Target
Trojan-Ransom.Win32.Babuk.a-2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.7z
-
Size
22KB
-
MD5
05736fead4f81b48adbb459dbc727d33
-
SHA1
ffcdcc5113cc6c2199d8522c0b8349bb847d2c5d
-
SHA256
22fee0b9c0435d8bea8ee63255ab4df89e167d10fad4e06909d5aa0a20c06d3f
-
SHA512
0e7046c299172e7d01d855fbe2e495992ee8be45a39e047a1128bf3250231a069770819ac0072f4d5bab96dd9d4532b42121f323ec16c1e50b58f07c1281adcb
-
SSDEEP
384:fu8K6uR9GJQkG12MRuj1qxMwys1iL7+kQer2l8JdhQg6LRpHx+4ZGYDvQVNzF:m8KjyQkGEWjawGL7z3hQtLBZIVN5
-
Babuk family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (178) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-