General
-
Target
2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex
-
Size
86KB
-
Sample
250411-f5fnfazze1
-
MD5
ef14d6ddb61187f3e21d84634d8a1be5
-
SHA1
9ba13927d59b16b15ecc8ad8a697bc62347459b3
-
SHA256
b072a614b15541b1fed03986cf88b2fa369169f11dededf2ac41f9ce422cae0e
-
SHA512
6c615c61673076c001b7ba493ac9fddc3f5eb53a9282bddffdd129064400d2e74b9c613d19cfdd95535ed45283e81acc7fdf9c19b78026191ab03bdc798a6fab
-
SSDEEP
1536:jvHJ5hiBMAMnL+by+PGuMsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2es4C:jvHJ/iBMAqeyXBsrQLOJgY8Zp8LHD4Xl
Static task
static1
Behavioral task
behavioral1
Sample
2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe
Resource
win10v2004-20250410-en
Malware Config
Extracted
C:\PerfLogs\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/da83db34f2e0c077f7b064e6556f127c0a91d7ae21f3855f0e7279ce14d5f406/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://vq3zf757tzpwhs7bulnr43d2rfg5fkvvfkhee2zhhzievuxrbnarmgqd.onion/3fbf8f220dae00bb6bb8539b9c6c86c4bf5c58ccf651542e3363dd131239edd6
Targets
-
-
Target
2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex
-
Size
86KB
-
MD5
ef14d6ddb61187f3e21d84634d8a1be5
-
SHA1
9ba13927d59b16b15ecc8ad8a697bc62347459b3
-
SHA256
b072a614b15541b1fed03986cf88b2fa369169f11dededf2ac41f9ce422cae0e
-
SHA512
6c615c61673076c001b7ba493ac9fddc3f5eb53a9282bddffdd129064400d2e74b9c613d19cfdd95535ed45283e81acc7fdf9c19b78026191ab03bdc798a6fab
-
SSDEEP
1536:jvHJ5hiBMAMnL+by+PGuMsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2es4C:jvHJ/iBMAqeyXBsrQLOJgY8Zp8LHD4Xl
-
Babuk family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-