General
-
Target
2025-04-11_80bf354ec21cd2e57ed63aa4e9881261_babuk_destroyer_elex
-
Size
86KB
-
Sample
250411-jgqehstky5
-
MD5
80bf354ec21cd2e57ed63aa4e9881261
-
SHA1
d43fa6f94ec61fa87db7043ecdc970d35d5726dd
-
SHA256
bc2f36b22ed4f31cda0ab5a87cc27e2c1a13dbf20c9f0f63947740a9d96e6eb1
-
SHA512
6833c0294c0fed5a0b55cfeefea3f9140c89c2a65b7f9ef6e8482e7a503d3cc6c97e0aabd5303f37d736b43e0790f74030bc7e1f0a61706589b8ac1d42e562c0
-
SSDEEP
1536:jvHJ5hiBMAMnL+by+PGuMsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2es4z:jvHJ/iBMAqeyXBsrQLOJgY8Zp8LHD4Xo
Static task
static1
Behavioral task
behavioral1
Sample
2025-04-11_80bf354ec21cd2e57ed63aa4e9881261_babuk_destroyer_elex.exe
Resource
win10v2004-20250410-en
Malware Config
Extracted
C:\Recovery\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/da83db34f2e0c077f7b064e6556f127c0a91d7ae21f3855f0e7279ce14d5f406/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://vq3zf757tzpwhs7bulnr43d2rfg5fkvvfkhee2zhhzievuxrbnarmgqd.onion/3fbf8f220dae00bb6bb8539b9c6c86c4bf5c58ccf651542e3363dd131239edd6
Targets
-
-
Target
2025-04-11_80bf354ec21cd2e57ed63aa4e9881261_babuk_destroyer_elex
-
Size
86KB
-
MD5
80bf354ec21cd2e57ed63aa4e9881261
-
SHA1
d43fa6f94ec61fa87db7043ecdc970d35d5726dd
-
SHA256
bc2f36b22ed4f31cda0ab5a87cc27e2c1a13dbf20c9f0f63947740a9d96e6eb1
-
SHA512
6833c0294c0fed5a0b55cfeefea3f9140c89c2a65b7f9ef6e8482e7a503d3cc6c97e0aabd5303f37d736b43e0790f74030bc7e1f0a61706589b8ac1d42e562c0
-
SSDEEP
1536:jvHJ5hiBMAMnL+by+PGuMsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2es4z:jvHJ/iBMAqeyXBsrQLOJgY8Zp8LHD4Xo
-
Babuk family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (173) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-